Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:02

General

  • Target

    11757171d81d68b3fa7ae27b728226a72f5325d7832144d90bdbfeadcb13cc15.exe

  • Size

    707KB

  • MD5

    22aadc07afbbf4fdde103fc299302bfb

  • SHA1

    ee1ad89828658d994dd5cf04651f2dc379994f9d

  • SHA256

    11757171d81d68b3fa7ae27b728226a72f5325d7832144d90bdbfeadcb13cc15

  • SHA512

    d52937d076d262c71c3e16cd9f0108a2233dce7718fcdc357049e3b2490737b9aa9120314ae1dc10f5e0d61626a835083b42c6319cc4f9342f97b99628040b8f

  • SSDEEP

    12288:Wy902w3CCOFspn5YvF3YbQjxdcfqz1dJWjmu8V8TdnyvmqgZxA7klTUpqQq:WyqjOFspn5W3YbIbcfqxd0KueIyDEt9T

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11757171d81d68b3fa7ae27b728226a72f5325d7832144d90bdbfeadcb13cc15.exe
    "C:\Users\Admin\AppData\Local\Temp\11757171d81d68b3fa7ae27b728226a72f5325d7832144d90bdbfeadcb13cc15.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un069467.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un069467.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\87138786.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\87138786.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1080
          4⤵
          • Program crash
          PID:3800
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk734429.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk734429.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3104 -ip 3104
    1⤵
      PID:2312

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un069467.exe

            Filesize

            553KB

            MD5

            eb8af514fe2f381d7540224ca290aaa2

            SHA1

            b06ce1f3edc7a85375ee4c00d6dad9a08243ce28

            SHA256

            aa0fbf94d7155b86fe68f917db7c18f6505712d2a77bb7c3c35c3b953a4b8355

            SHA512

            ae89c0537d94e9ef7711ce1c0f178e589240c331d61d32d379db2c6cab68160a609db68c586883608620a64155b4b33901c860a8ae1f15ec4e45ac695f3bc81d

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\87138786.exe

            Filesize

            258KB

            MD5

            e0f7f2e52eb077353a2144d56ccc8ae1

            SHA1

            74d918f3a0861824eb5a71f5e133dd715e9b5647

            SHA256

            0df672ebb2e715c59f75c31b4ce58d21985d75d131323b4b895dba808144bfdf

            SHA512

            7b685ca990ef86a77bb0fa7472be8cc305717a3924de6b9c7132c8d2cb22cfb62823eea97fe7c1e97b95e7a7657cab51d491a850c038e5b7eb7d5dd99bd4ceab

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk734429.exe

            Filesize

            353KB

            MD5

            375690f9bcebb4a370c2f480f5fb8b82

            SHA1

            afd2a1ac67d27d2555be642ca42cfdc8c078e864

            SHA256

            c9f175a1316a845cd95b1857f07f6e91733bf301b47b5d10e5c20df1baa6dfa4

            SHA512

            31ac9416a203b0aa1276f0e397e197922ee32d5b188e731cb86cb92199a4742eb50cbc6bd04e25a720504483f5f6e4fcfd486a6a24c364ca0acbf9421d3d988b

          • memory/2908-71-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-77-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-855-0x000000000A340000-0x000000000A352000-memory.dmp

            Filesize

            72KB

          • memory/2908-854-0x0000000009CD0000-0x000000000A2E8000-memory.dmp

            Filesize

            6.1MB

          • memory/2908-62-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-63-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-65-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-67-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-91-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-69-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-857-0x000000000A480000-0x000000000A4BC000-memory.dmp

            Filesize

            240KB

          • memory/2908-858-0x0000000004C40000-0x0000000004C8C000-memory.dmp

            Filesize

            304KB

          • memory/2908-73-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-856-0x000000000A360000-0x000000000A46A000-memory.dmp

            Filesize

            1.0MB

          • memory/2908-81-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-83-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-85-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-87-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-89-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-93-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-95-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-79-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-75-0x00000000071D0000-0x0000000007205000-memory.dmp

            Filesize

            212KB

          • memory/2908-61-0x00000000071D0000-0x000000000720A000-memory.dmp

            Filesize

            232KB

          • memory/2908-60-0x0000000007150000-0x000000000718C000-memory.dmp

            Filesize

            240KB

          • memory/3104-38-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-54-0x0000000000400000-0x0000000002B9B000-memory.dmp

            Filesize

            39.6MB

          • memory/3104-55-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3104-51-0x0000000000400000-0x0000000002B9B000-memory.dmp

            Filesize

            39.6MB

          • memory/3104-52-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3104-50-0x0000000002BA0000-0x0000000002BCD000-memory.dmp

            Filesize

            180KB

          • memory/3104-49-0x0000000002C90000-0x0000000002D90000-memory.dmp

            Filesize

            1024KB

          • memory/3104-21-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-22-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-24-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-26-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-28-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-30-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-32-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-34-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-36-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-40-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-44-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-46-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-48-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-42-0x0000000004BE0000-0x0000000004BF3000-memory.dmp

            Filesize

            76KB

          • memory/3104-20-0x0000000004BE0000-0x0000000004BF8000-memory.dmp

            Filesize

            96KB

          • memory/3104-19-0x0000000007390000-0x0000000007934000-memory.dmp

            Filesize

            5.6MB

          • memory/3104-18-0x00000000047F0000-0x000000000480A000-memory.dmp

            Filesize

            104KB

          • memory/3104-16-0x0000000002BA0000-0x0000000002BCD000-memory.dmp

            Filesize

            180KB

          • memory/3104-17-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3104-15-0x0000000002C90000-0x0000000002D90000-memory.dmp

            Filesize

            1024KB