Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:03

General

  • Target

    828e1ac899b3e47895182811dfea5c20a4ffbf50707f7b95f74fff9e5095d7ea.exe

  • Size

    694KB

  • MD5

    2deaff136047a2b1b6d2f127b3da465a

  • SHA1

    aec22e9b4675c6ecae84edbe6f85f56ebba2b14a

  • SHA256

    828e1ac899b3e47895182811dfea5c20a4ffbf50707f7b95f74fff9e5095d7ea

  • SHA512

    f1f83473b7fae8102ce9987e572402beb35a0ff8397a0450c3c3689d56ee09192137a0ebe73e4851742b55ec10deebdc1dacb447836d55bdf7b65d0b8a43b732

  • SSDEEP

    12288:ey90Rt7t0yG2ti4ZI9WOwcHNUrBIhMKrzb6IrwZGVN77z/KWTnNc8:eyk7E2Q4OiCNcBezPcON77zZjy8

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\828e1ac899b3e47895182811dfea5c20a4ffbf50707f7b95f74fff9e5095d7ea.exe
    "C:\Users\Admin\AppData\Local\Temp\828e1ac899b3e47895182811dfea5c20a4ffbf50707f7b95f74fff9e5095d7ea.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094663.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094663.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53224800.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53224800.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4724
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 1100
          4⤵
          • Program crash
          PID:4828
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk931600.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk931600.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4000
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4724 -ip 4724
    1⤵
      PID:4916

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094663.exe

            Filesize

            540KB

            MD5

            da6e5ef1a6e9eff9f48f61184d120ea0

            SHA1

            a9dc4fdd90eb607ae03aeb8b358879b989224796

            SHA256

            4bd60f370fa64bdab139ca68536c90a6370b1826a6d7117efbea3d06c3ea0e99

            SHA512

            b30b8dce488d430f630d5d7020b5e870a8bd1a047081d9a99785ecf966562723b9331fd80544d92d42744fc356da8462a38c95ab2d7e621cb4c1f8cfee915024

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53224800.exe

            Filesize

            258KB

            MD5

            fdda21ab82a198d66ed008afb7fec34d

            SHA1

            55380a21f145124b26e92c519ca1bf1c4e639f7d

            SHA256

            52ffddea2f5bd6f476a58660098e24dfb6e2568f9969122a20cb1bd677c6cade

            SHA512

            897f02fe0723a22ff1be206e0228498cdaece7d4bf9baa6813146db0bbdf1426db86094f619cd6af501f694f4889230fb881a1ca1d9be2e8f607f01e90fbda5a

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk931600.exe

            Filesize

            341KB

            MD5

            797d059ba279a43c0689e69416d41082

            SHA1

            12b4af97ae8d97e2506ae6158bf16104a5b9fddc

            SHA256

            ed62b98920962c503ae98e2637d3b5623a9d4960134d913bc157720d9608b98d

            SHA512

            52a73e72df5a7fce956c0cfe452d49ce0bc93288f883e047b598566e123f6f6f98e66335bc12e33f497a7684bc055405f80c3820515f2c78c14d1a67719d1fbe

          • memory/4000-92-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-76-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-854-0x00000000072D0000-0x00000000072E2000-memory.dmp

            Filesize

            72KB

          • memory/4000-853-0x0000000009D30000-0x000000000A348000-memory.dmp

            Filesize

            6.1MB

          • memory/4000-78-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-80-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-84-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-86-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-88-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-90-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-856-0x000000000A470000-0x000000000A4AC000-memory.dmp

            Filesize

            240KB

          • memory/4000-59-0x0000000007120000-0x000000000715C000-memory.dmp

            Filesize

            240KB

          • memory/4000-94-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-855-0x000000000A350000-0x000000000A45A000-memory.dmp

            Filesize

            1.0MB

          • memory/4000-61-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-62-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-64-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-82-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-68-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-70-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-72-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-74-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-66-0x00000000071A0000-0x00000000071D5000-memory.dmp

            Filesize

            212KB

          • memory/4000-60-0x00000000071A0000-0x00000000071DA000-memory.dmp

            Filesize

            232KB

          • memory/4000-857-0x0000000006C10000-0x0000000006C5C000-memory.dmp

            Filesize

            304KB

          • memory/4724-38-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-53-0x0000000000400000-0x0000000002B9B000-memory.dmp

            Filesize

            39.6MB

          • memory/4724-54-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/4724-51-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/4724-50-0x0000000000400000-0x0000000002B9B000-memory.dmp

            Filesize

            39.6MB

          • memory/4724-49-0x0000000002C20000-0x0000000002D20000-memory.dmp

            Filesize

            1024KB

          • memory/4724-21-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-22-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-24-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-26-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-28-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-30-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-32-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-34-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-36-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-42-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-44-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-46-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-48-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-40-0x0000000004C80000-0x0000000004C93000-memory.dmp

            Filesize

            76KB

          • memory/4724-20-0x0000000004C80000-0x0000000004C98000-memory.dmp

            Filesize

            96KB

          • memory/4724-19-0x00000000073D0000-0x0000000007974000-memory.dmp

            Filesize

            5.6MB

          • memory/4724-18-0x0000000004AE0000-0x0000000004AFA000-memory.dmp

            Filesize

            104KB

          • memory/4724-16-0x0000000002BA0000-0x0000000002BCD000-memory.dmp

            Filesize

            180KB

          • memory/4724-17-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/4724-15-0x0000000002C20000-0x0000000002D20000-memory.dmp

            Filesize

            1024KB