Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 03:57

General

  • Target

    583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe

  • Size

    943KB

  • MD5

    a29e809d44553ccd266f174ea49b2d51

  • SHA1

    119559cd61e275cd468daa76d4797c7685154268

  • SHA256

    583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d

  • SHA512

    8cf0022787aaa741a270367137fef0e910832995ff21db7d0825c637a0c8208f3eb1fd1ff4bcf168fed27ee681206bd5c442f66c3dc662a1972d0cf4e4a567af

  • SSDEEP

    24576:RyXSNrtnBivPFdpx0WbKdmNnsC6Ch+7LvQak3M+yoqKNi:EXSNrdjdm6C6CUPQak3Mp2

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe
    "C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:964
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 1012
            5⤵
            • Program crash
            PID:3028
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:448
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 964 -ip 964
    1⤵
      PID:3920

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe

            Filesize

            695KB

            MD5

            a9e6a3be634bf01000c66d441618889a

            SHA1

            facfbfa31e094fa29ad20f4bb68ee9e02b69afd2

            SHA256

            bee5a83804b534864320d33d1dbcd28e495c9d831706addaf0760a1831328999

            SHA512

            f935c154d605fc6f5c8670a04154b0f9d6e9d7d8df9377ea848e59a03010982b1a413015009270af436bb9c843e8a29fac6629257c721ae13930f1ae8d9be70c

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe

            Filesize

            541KB

            MD5

            f64b8d69bcaae2e59553f73cd4040e6c

            SHA1

            bde6775941f318666424ccc0af259d052caed609

            SHA256

            d884f3d690e5a0db56e119703f3591e9cb63952d44ae09467c8ee0edbacc363e

            SHA512

            039137ea54607c3da6d4a5c284b2040882a6f0652d94cbff8bf112b701106271e968b2239033b3ca2d82fcf7d2da45e38b7993a76d717c2b4bbbc7d938001cf3

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe

            Filesize

            278KB

            MD5

            66a3fcb7f5889b73570758b581abfe24

            SHA1

            3e39b0c92f43063866c7725b03f46851407bbd3d

            SHA256

            2355403791a12ccd571cf44ec0451d605d563f04816dce5406f74560265a73f1

            SHA512

            6a81dfd51478e86a2b09faab56f108cfca63634fb9d00a1eba42057806734b663bc0bac1a55fc2eb8a06a001ef4c0083def19b429505d7623c38b86229129800

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe

            Filesize

            361KB

            MD5

            a5393eae281839270006e2f299a3ecb5

            SHA1

            27f0deb89322b09bdd23591c129ad30698a46396

            SHA256

            62387b38d4f9389377fa017bc045a423b49f267dd784f2743bdf30c40f9f1535

            SHA512

            c8c2828fa3e8630d86ac7a10af7d2b76aa0c0ab67b34a855d8dc8d76af53e8d61e1c84fa565f19dc90558cbd856cfd994a9266fd4b59c8d1a25a5730376219c5

          • memory/448-77-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-95-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-858-0x0000000004AA0000-0x0000000004AEC000-memory.dmp

            Filesize

            304KB

          • memory/448-857-0x000000000A490000-0x000000000A4CC000-memory.dmp

            Filesize

            240KB

          • memory/448-856-0x000000000A360000-0x000000000A46A000-memory.dmp

            Filesize

            1.0MB

          • memory/448-62-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-63-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-65-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-67-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-81-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-69-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-73-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-71-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-94-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-75-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-79-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-855-0x000000000A340000-0x000000000A352000-memory.dmp

            Filesize

            72KB

          • memory/448-83-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-854-0x0000000009D20000-0x000000000A338000-memory.dmp

            Filesize

            6.1MB

          • memory/448-85-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-60-0x0000000007140000-0x000000000717C000-memory.dmp

            Filesize

            240KB

          • memory/448-61-0x00000000071C0000-0x00000000071FA000-memory.dmp

            Filesize

            232KB

          • memory/448-87-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-89-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/448-91-0x00000000071C0000-0x00000000071F5000-memory.dmp

            Filesize

            212KB

          • memory/964-34-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-32-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-28-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-24-0x0000000004C00000-0x0000000004C18000-memory.dmp

            Filesize

            96KB

          • memory/964-55-0x0000000000400000-0x0000000002BA6000-memory.dmp

            Filesize

            39.6MB

          • memory/964-23-0x0000000007240000-0x00000000077E4000-memory.dmp

            Filesize

            5.6MB

          • memory/964-53-0x0000000000400000-0x0000000002BA6000-memory.dmp

            Filesize

            39.6MB

          • memory/964-22-0x0000000004840000-0x000000000485A000-memory.dmp

            Filesize

            104KB

          • memory/964-26-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-30-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-36-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-38-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-40-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-42-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-44-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-46-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-48-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-50-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-52-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB

          • memory/964-25-0x0000000004C00000-0x0000000004C12000-memory.dmp

            Filesize

            72KB