Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:50

General

  • Target

    7ab02532136b0f8dc42de866be5bac0cad35532b51776d2489f041c81961c365.exe

  • Size

    691KB

  • MD5

    135e833eba52dc3a629f9db8dafa94a3

  • SHA1

    20c2b9be22893d577396cc17a9f5a7d3cb29e650

  • SHA256

    7ab02532136b0f8dc42de866be5bac0cad35532b51776d2489f041c81961c365

  • SHA512

    b180bb2bfd94af9fa66dc84bde158a26df3b0e66594a047d397f6921be8557b294032b1e32e6ade770fe4b410e5ad34918ec54c525f0a92853c9dca6c6200d28

  • SSDEEP

    12288:+y90YDZ6hErxzJBv0bVpBL3mqp4SuyCZR4V/e2m7zfKANB3P32xUL:+y/ldzJNYX3mfygsG2hANQOL

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ab02532136b0f8dc42de866be5bac0cad35532b51776d2489f041c81961c365.exe
    "C:\Users\Admin\AppData\Local\Temp\7ab02532136b0f8dc42de866be5bac0cad35532b51776d2489f041c81961c365.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un278165.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un278165.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72294122.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72294122.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3376
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 1084
          4⤵
          • Program crash
          PID:5044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk339003.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk339003.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk339003.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk339003.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2764
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si610323.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si610323.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4288
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3376 -ip 3376
    1⤵
      PID:3164

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si610323.exe

            Filesize

            136KB

            MD5

            e1c805d3cefe221689da30b8a2d944f2

            SHA1

            a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

            SHA256

            32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

            SHA512

            7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un278165.exe

            Filesize

            537KB

            MD5

            12da2783e1b432da607735c52ce07dbf

            SHA1

            2ac7094fe57501e5f7f08c6d80f77c619434abc4

            SHA256

            d87b2f4948b50d549980c6bcfa461f150d06eb4d11272832c95e16a0dcd762d7

            SHA512

            2b8e49c1cd8f9f36b12612ed8515743a8c3910e1ce835635f4db6ebb1f6e05ff7193eacdc6c2f783df24da46acef12dbb0ae61648093302e907d93491a74ed92

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\72294122.exe

            Filesize

            259KB

            MD5

            4b041848170889675eee3ef3a00f051e

            SHA1

            e5d6b1e0a20b41f0f03c69125daa9a4e66dd014a

            SHA256

            80dadce5be2f032ff070ad07aa321fcf8a02604d686fb59dcf9ba47b4c1ce9ab

            SHA512

            4d92bbf0f2b0de9551f5c2d2b32b95befd963d9b85c1f574f359d152e87506728044231c6d19b6db4a49877b22dd32068bb6abe5b4f3a035080b51a7339d1989

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk339003.exe

            Filesize

            342KB

            MD5

            d9482cf2d5c5624cab3098b6d6ba6a88

            SHA1

            aedfc5a1b6fa76377d8d3f6c7c3bfff9b969820c

            SHA256

            ecaa6197ed8732043962cd6c65af0d14570bb4b9442d415bee999e708418149c

            SHA512

            b6e295a5b4591f99d285d036fed72066931c221cff0a2258df1235376bfe7eb13106943231407b6e1bccf685b0e5696cd294389b0e87d400ec7f2def4221ca93

          • memory/2764-91-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-97-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-79-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-81-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-83-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-85-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-87-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-89-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-75-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-95-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-73-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-77-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-99-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-101-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-93-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-70-0x00000000049B0000-0x00000000049EA000-memory.dmp

            Filesize

            232KB

          • memory/2764-68-0x0000000002390000-0x00000000023CC000-memory.dmp

            Filesize

            240KB

          • memory/2764-72-0x00000000049B0000-0x00000000049E5000-memory.dmp

            Filesize

            212KB

          • memory/2764-63-0x0000000000400000-0x0000000000449000-memory.dmp

            Filesize

            292KB

          • memory/2764-65-0x0000000000400000-0x0000000000449000-memory.dmp

            Filesize

            292KB

          • memory/2764-61-0x0000000000400000-0x0000000000449000-memory.dmp

            Filesize

            292KB

          • memory/3376-35-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-43-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-55-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/3376-56-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3376-51-0x00000000020A0000-0x00000000020CD000-memory.dmp

            Filesize

            180KB

          • memory/3376-50-0x0000000000490000-0x0000000000590000-memory.dmp

            Filesize

            1024KB

          • memory/3376-22-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-23-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-39-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-45-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-26-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-15-0x0000000000490000-0x0000000000590000-memory.dmp

            Filesize

            1024KB

          • memory/3376-27-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-29-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-31-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-34-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-41-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-52-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3376-47-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-49-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-37-0x0000000002450000-0x0000000002463000-memory.dmp

            Filesize

            76KB

          • memory/3376-21-0x0000000002450000-0x0000000002468000-memory.dmp

            Filesize

            96KB

          • memory/3376-20-0x0000000004AC0000-0x0000000005064000-memory.dmp

            Filesize

            5.6MB

          • memory/3376-19-0x00000000022D0000-0x00000000022EA000-memory.dmp

            Filesize

            104KB

          • memory/3376-18-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/3376-17-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3376-16-0x00000000020A0000-0x00000000020CD000-memory.dmp

            Filesize

            180KB

          • memory/4288-71-0x0000000000700000-0x0000000000728000-memory.dmp

            Filesize

            160KB

          • memory/4288-460-0x00000000079E0000-0x0000000007FF8000-memory.dmp

            Filesize

            6.1MB

          • memory/4288-730-0x0000000007590000-0x000000000769A000-memory.dmp

            Filesize

            1.0MB

          • memory/4288-729-0x0000000007460000-0x0000000007472000-memory.dmp

            Filesize

            72KB

          • memory/4288-867-0x00000000074F0000-0x000000000752C000-memory.dmp

            Filesize

            240KB

          • memory/4288-868-0x00000000027B0000-0x00000000027FC000-memory.dmp

            Filesize

            304KB