Analysis
- max time kernel
142s - max time network
150s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
09/11/2024, 03:48
General
- Target 9b002f8fa2ae9837746556b41e165ee691b4fe5190eba57ba5838c2094195e0e.exe
- Size 1.0MB
- Sample241109-ec8cbaxbkl
- SHA256 9b002f8fa2ae9837746556b41e165ee691b4fe5190eba57ba5838c2094195e0e
Malware Config
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 19 IoCs
- Redline family
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 10 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b002f8fa2ae9837746556b41e165ee691b4fe5190eba57ba5838c2094195e0e.exe"C:\Users\Admin\AppData\Local\Temp\9b002f8fa2ae9837746556b41e165ee691b4fe5190eba57ba5838c2094195e0e.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lF272076.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lF272076.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qD163070.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qD163070.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\162451254.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\162451254.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\272189732.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\272189732.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
272189732.exe
lF272076.exe
qD163070.exe
162451254.exe
memory/1016-0-0x0000000002C70000-0x0000000002D51000-memory.dmp
memory/1016-1-0x0000000002C70000-0x0000000002D51000-memory.dmp
memory/1016-2-0x0000000004600000-0x00000000046EB000-memory.dmp
memory/1016-9-0x0000000000400000-0x00000000004EE000-memory.dmp
memory/1016-70-0x0000000000400000-0x0000000002C62000-memory.dmp
memory/1016-71-0x0000000000400000-0x00000000004EE000-memory.dmp
memory/1016-69-0x0000000004600000-0x00000000046EB000-memory.dmp
memory/1016-68-0x0000000002C70000-0x0000000002D51000-memory.dmp
memory/2300-63-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-62-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-59-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-57-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-55-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-53-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-51-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-47-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-45-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-43-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-41-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-40-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-65-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-67-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-49-0x0000000003330000-0x0000000003342000-memory.dmp
memory/2300-39-0x0000000003330000-0x0000000003348000-memory.dmp
memory/2300-73-0x0000000000400000-0x0000000002B9E000-memory.dmp
memory/2300-38-0x00000000032F0000-0x000000000330A000-memory.dmp
memory/2700-84-0x00000000049D0000-0x0000000004A0C000-memory.dmp
memory/2700-105-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-99-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-117-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-115-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-113-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-111-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-109-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-107-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-85-0x0000000004A30000-0x0000000004A6A000-memory.dmp
memory/2700-103-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-101-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-97-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-95-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-93-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-91-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-89-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-87-0x0000000004A30000-0x0000000004A65000-memory.dmp
memory/2700-86-0x0000000004A30000-0x0000000004A65000-memory.dmp