Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:47

General

  • Target

    45ec49557d84ba861e50f20bf965b64e1fb8c845bb20eb382732a5a6ec8104b3.exe

  • Size

    591KB

  • MD5

    b51941c161f11581ac3eb130008991bb

  • SHA1

    8184f298f6c4d849bcee1ce86b3b982a095d848e

  • SHA256

    45ec49557d84ba861e50f20bf965b64e1fb8c845bb20eb382732a5a6ec8104b3

  • SHA512

    7a172e5b8c49ce14f8a1ba1f16311a0165a9d64dd7b47cefa6bf060d0d8d94c2abbb161c3d3823e0903adaee5ffd58771aa0914bc6423d233ba5e0c758e2d4a3

  • SSDEEP

    12288:gy90oRB/53jL0BkNJkDh3l60AMOJ/7Cf99JJBt7Xs+rr2:gyf53jL0kXKhV6DTWR7Xfra

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45ec49557d84ba861e50f20bf965b64e1fb8c845bb20eb382732a5a6ec8104b3.exe
    "C:\Users\Admin\AppData\Local\Temp\45ec49557d84ba861e50f20bf965b64e1fb8c845bb20eb382732a5a6ec8104b3.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\52550441.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\52550441.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2076
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1080
        3⤵
        • Program crash
        PID:1284
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk430340.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk430340.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:336
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2076 -ip 2076
    1⤵
      PID:4652

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\52550441.exe

      Filesize

      376KB

      MD5

      63bd15815c608e58c77a4124d95d14e0

      SHA1

      58c177c964dabca73b8b015c6600097a17074cf1

      SHA256

      78f86cc69e40f6fb6c96e5cdb4c360d73d90d6db4d4c2ae98f4a970788e13ca2

      SHA512

      df7d96dfc2f97f7b17314ae0d72ad157669b5a9a86cea97ecaac2efe2de34f9db1c3c5e6616ce9de8bf12c8e005d011353002e907ae04369400545f8b2a08e33

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk430340.exe

      Filesize

      459KB

      MD5

      492120920c1743282cf243c68ad591fe

      SHA1

      ca0cf22c326f364f380f226e70c2b82c9e5ff3fa

      SHA256

      27a02d3671e2519f23e55dd38c568080d098fb7eefb252ebe55c53510d861e3f

      SHA512

      c9f07d3ecf5e194794584e48e39b5b29d5fa4adae3edd8b7faa852c84c44cd5706db4893b7e1d99223d43e0661a643e9be21ce38ccd0cca45dc41844c71908fa

    • memory/336-69-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-57-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-852-0x0000000002840000-0x000000000288C000-memory.dmp

      Filesize

      304KB

    • memory/336-851-0x00000000080E0000-0x000000000811C000-memory.dmp

      Filesize

      240KB

    • memory/336-850-0x0000000007FC0000-0x00000000080CA000-memory.dmp

      Filesize

      1.0MB

    • memory/336-849-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

      Filesize

      72KB

    • memory/336-848-0x0000000007940000-0x0000000007F58000-memory.dmp

      Filesize

      6.1MB

    • memory/336-53-0x00000000029F0000-0x0000000002A2C000-memory.dmp

      Filesize

      240KB

    • memory/336-59-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-65-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-52-0x0000000000400000-0x0000000000817000-memory.dmp

      Filesize

      4.1MB

    • memory/336-56-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-54-0x0000000000400000-0x0000000000817000-memory.dmp

      Filesize

      4.1MB

    • memory/336-55-0x0000000004E20000-0x0000000004E5A000-memory.dmp

      Filesize

      232KB

    • memory/336-61-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-63-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-67-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-71-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-75-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-77-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-79-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-84-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-85-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-89-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-81-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-73-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/336-87-0x0000000004E20000-0x0000000004E55000-memory.dmp

      Filesize

      212KB

    • memory/2076-27-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-29-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-10-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/2076-47-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2076-46-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/2076-43-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2076-42-0x0000000000A10000-0x0000000000B10000-memory.dmp

      Filesize

      1024KB

    • memory/2076-14-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-17-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-19-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-8-0x0000000000A10000-0x0000000000B10000-memory.dmp

      Filesize

      1024KB

    • memory/2076-21-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-23-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-25-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-9-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2076-31-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-33-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-35-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-37-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-39-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-41-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-15-0x0000000002640000-0x0000000002652000-memory.dmp

      Filesize

      72KB

    • memory/2076-13-0x0000000002640000-0x0000000002658000-memory.dmp

      Filesize

      96KB

    • memory/2076-12-0x0000000005140000-0x00000000056E4000-memory.dmp

      Filesize

      5.6MB

    • memory/2076-11-0x00000000024B0000-0x00000000024CA000-memory.dmp

      Filesize

      104KB