Analysis

  • max time kernel
    144s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 04:59

General

  • Target

    e11f5a2414831f728a7e1623c17544d92ab9932b4116a88c380a1b3916ffbde0.exe

  • Size

    1.1MB

  • MD5

    673151c57961fcd262d494cda0fd2962

  • SHA1

    55ebeb539efcdaba86b089f5ec7c2b6240711dcd

  • SHA256

    e11f5a2414831f728a7e1623c17544d92ab9932b4116a88c380a1b3916ffbde0

  • SHA512

    21b26dfc4b6e927f656e97295d94dd211f304ce4ecc599dd12d046e300c166143635defa39a91869c03d39923d0e2ade72162dedb5409d693fc56c07b662a524

  • SSDEEP

    24576:YypMtpV4x/fy/b8XftHvBZcCTdBACKl3RqyuFpK3qaNecz5tO7yNhVIveS:YyWVk6/b8tH5ZrTxxyMp4VNr5hVge

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e11f5a2414831f728a7e1623c17544d92ab9932b4116a88c380a1b3916ffbde0.exe
    "C:\Users\Admin\AppData\Local\Temp\e11f5a2414831f728a7e1623c17544d92ab9932b4116a88c380a1b3916ffbde0.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4000
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4352
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 1080
            5⤵
            • Program crash
            PID:3168
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3616
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4352 -ip 4352
    1⤵
      PID:3472

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe

            Filesize

            719KB

            MD5

            d65c8e9f391cf20655232c5c987b746f

            SHA1

            bfce684cea9f3ad1f8319e3dd581f58ec22df410

            SHA256

            0376e92c9fdd3170bd6c4589d0ab56494bbef6ebb0c1ec8c2be1ea0c637281dc

            SHA512

            226c17e238df5c15eb0a90d5e6922f131e45daa44bee1d7dffe934068cb0db54e03fb23d45826e6daf21f5251bc1cfa65948f19dc45c4c9099376f724e342597

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe

            Filesize

            548KB

            MD5

            79bb8aa7f82a94ba01dc4b70c63957e0

            SHA1

            535a7c0407de96fdce4bf3017f07b4333e9acc01

            SHA256

            337c493481660ea88e0c92612f9caafff009cf7820f9fb84746b24ed2b64fff9

            SHA512

            c7adba7203490aee60aa1b678632df1b1b168f47810bc927978f9b8b7e8ace467446c58f8ae85f3f5bbd3fa4cbae2ace32f67b893c02282de618878b98b50139

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe

            Filesize

            278KB

            MD5

            e1b364b4b96ca742b39a069ca1390a0b

            SHA1

            970e15712c7b43117b2144d2dbf2aed590fff249

            SHA256

            dc2f6a4b3d395642bdd40c133807093078b2e6b7f4e683a878d63e258d58cb4b

            SHA512

            4b48624e84da9949c79e3116f9327cd1f1cd1a68cf495db1c7203db470fc668afca3f48674fc47244e6d6e9157a0d3adaa22183a20470a57df1c5f4a31f8573d

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe

            Filesize

            360KB

            MD5

            848ce28183931ae67c8a0d8ce3a1efc3

            SHA1

            a39582bf82be42b8cf83b0015130273ab0e51c90

            SHA256

            1920e51f6e64752f4dd7474638b8d86c646e1b8cc4099415d2319d038fe1aff3

            SHA512

            430e793cac623274f0082eaec2377e946d9238f394837272ea4237ef305a00b3db28c081d6c82d2fbcadab0dc5a11769ebd9423e9129279a91ffe4b7aeae4b1d

          • memory/3616-77-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-79-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-864-0x000000000A370000-0x000000000A47A000-memory.dmp

            Filesize

            1.0MB

          • memory/3616-863-0x000000000A350000-0x000000000A362000-memory.dmp

            Filesize

            72KB

          • memory/3616-862-0x0000000009C90000-0x000000000A2A8000-memory.dmp

            Filesize

            6.1MB

          • memory/3616-70-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-71-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-73-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-75-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-101-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-866-0x0000000006C60000-0x0000000006CAC000-memory.dmp

            Filesize

            304KB

          • memory/3616-865-0x000000000A490000-0x000000000A4CC000-memory.dmp

            Filesize

            240KB

          • memory/3616-81-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-83-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-89-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-91-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-93-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-95-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-97-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-99-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-87-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-85-0x0000000007760000-0x0000000007795000-memory.dmp

            Filesize

            212KB

          • memory/3616-69-0x0000000007760000-0x000000000779A000-memory.dmp

            Filesize

            232KB

          • memory/3616-68-0x0000000007130000-0x000000000716C000-memory.dmp

            Filesize

            240KB

          • memory/4352-46-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-38-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-63-0x0000000000400000-0x0000000002BAF000-memory.dmp

            Filesize

            39.7MB

          • memory/4352-26-0x0000000004930000-0x000000000494A000-memory.dmp

            Filesize

            104KB

          • memory/4352-27-0x0000000007160000-0x0000000007704000-memory.dmp

            Filesize

            5.6MB

          • memory/4352-28-0x0000000007710000-0x0000000007728000-memory.dmp

            Filesize

            96KB

          • memory/4352-54-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-29-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-30-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-32-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-34-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-56-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-36-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-61-0x0000000000400000-0x0000000002BAF000-memory.dmp

            Filesize

            39.7MB

          • memory/4352-40-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-42-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-44-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-52-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-48-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4352-51-0x0000000007710000-0x0000000007722000-memory.dmp

            Filesize

            72KB

          • memory/4816-2-0x0000000002860000-0x000000000293D000-memory.dmp

            Filesize

            884KB

          • memory/4816-57-0x0000000002740000-0x0000000002819000-memory.dmp

            Filesize

            868KB

          • memory/4816-58-0x0000000002860000-0x000000000293D000-memory.dmp

            Filesize

            884KB

          • memory/4816-60-0x0000000000400000-0x00000000004E1000-memory.dmp

            Filesize

            900KB

          • memory/4816-59-0x0000000000400000-0x00000000008BD000-memory.dmp

            Filesize

            4.7MB

          • memory/4816-3-0x0000000000400000-0x00000000004E1000-memory.dmp

            Filesize

            900KB

          • memory/4816-1-0x0000000002740000-0x0000000002819000-memory.dmp

            Filesize

            868KB