Analysis
- max time kernel
144s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
09/11/2024, 03:48
General
- Target 9b002f8fa2ae9837746556b41e165ee691b4fe5190eba57ba5838c2094195e0e.exe
- Size 1.0MB
- Sample241109-ec8cbaxbkl
- SHA256 9b002f8fa2ae9837746556b41e165ee691b4fe5190eba57ba5838c2094195e0e
Malware Config
Signatures
- Detects Healer an antivirus disabler dropper 17 IoCs
- Healer
Healer an antivirus disabler dropper.
- Healer family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 19 IoCs
- Redline family
- Executes dropped EXE 4 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b002f8fa2ae9837746556b41e165ee691b4fe5190eba57ba5838c2094195e0e.exe"C:\Users\Admin\AppData\Local\Temp\9b002f8fa2ae9837746556b41e165ee691b4fe5190eba57ba5838c2094195e0e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lF272076.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lF272076.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qD163070.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qD163070.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\162451254.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\162451254.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 10805⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\272189732.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\272189732.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 556 -ip 5561⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
lF272076.exe
qD163070.exe
162451254.exe
272189732.exe
memory/556-52-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-50-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-26-0x00000000046F0000-0x000000000470A000-memory.dmp
memory/556-27-0x0000000007240000-0x00000000077E4000-memory.dmp
memory/556-28-0x0000000004C40000-0x0000000004C58000-memory.dmp
memory/556-34-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-36-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-54-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-61-0x0000000000400000-0x0000000002B9E000-memory.dmp
memory/556-63-0x0000000000400000-0x0000000002B9E000-memory.dmp
memory/556-48-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-46-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-44-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-40-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-38-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-32-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-30-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-42-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-29-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/556-56-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/1596-70-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-87-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-866-0x0000000004C40000-0x0000000004C8C000-memory.dmp
memory/1596-865-0x000000000A480000-0x000000000A4BC000-memory.dmp
memory/1596-864-0x000000000A360000-0x000000000A46A000-memory.dmp
memory/1596-863-0x000000000A340000-0x000000000A352000-memory.dmp
memory/1596-862-0x0000000009C80000-0x000000000A298000-memory.dmp
memory/1596-68-0x0000000007130000-0x000000000716C000-memory.dmp
memory/1596-69-0x0000000007760000-0x000000000779A000-memory.dmp
memory/1596-75-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-77-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-95-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-81-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-73-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-71-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-79-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-101-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-99-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-97-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-93-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-91-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-89-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-83-0x0000000007760000-0x0000000007795000-memory.dmp
memory/1596-85-0x0000000007760000-0x0000000007795000-memory.dmp
memory/2080-59-0x0000000004AD0000-0x0000000004BBB000-memory.dmp
memory/2080-1-0x00000000049E0000-0x0000000004AC4000-memory.dmp
memory/2080-2-0x0000000004AD0000-0x0000000004BBB000-memory.dmp
memory/2080-3-0x0000000000400000-0x00000000004EE000-memory.dmp
memory/2080-57-0x00000000049E0000-0x0000000004AC4000-memory.dmp
memory/2080-60-0x0000000000400000-0x00000000004EE000-memory.dmp
memory/2080-58-0x0000000000400000-0x0000000002C62000-memory.dmp