Analysis

  • max time kernel
    139s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:04

General

  • Target

    758e36f0b6920f57a3b0b43b6f3a6f217895a19e43b42e440135857aa759fb9e.exe

  • Size

    479KB

  • MD5

    92f35a184864d794c21f6563cf89c024

  • SHA1

    1657a6ede4e9bd80c79da934ae924d55e646dd5b

  • SHA256

    758e36f0b6920f57a3b0b43b6f3a6f217895a19e43b42e440135857aa759fb9e

  • SHA512

    e6c4fbb3e03edaacf8f0838e87b301bcca6aa0f7451ac367e047d33332d12e44d1c2e37c76ed3920034dd4e73741c870b406a51512f6c26282612c4b0a431743

  • SSDEEP

    12288:XMr9y900FrS6lQd+TeeQbmyzb+dZQzBzKOqfIqh1Ii8E1:CybFrS6lQdb1zadZQzcOqfznIi86

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\758e36f0b6920f57a3b0b43b6f3a6f217895a19e43b42e440135857aa759fb9e.exe
    "C:\Users\Admin\AppData\Local\Temp\758e36f0b6920f57a3b0b43b6f3a6f217895a19e43b42e440135857aa759fb9e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0548186.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0548186.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7578256.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7578256.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1932
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1375229.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1375229.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1620

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0548186.exe

          Filesize

          307KB

          MD5

          f2135ae35446adb296e45b563e8ea95f

          SHA1

          6cfa21a42af381ed44c5885c16c095e57b6c6880

          SHA256

          8a19314234a24bbd87e1eb351403ca5cd067f313383763f6a544ffebe6d81688

          SHA512

          b227693e204d5f87bc1ce1680062ddc921a61116571a37b3a3cdc0b4ad9bf80046cb2e4ebbff1da32b69964715d23dbaf7d95265dc869252f78726b47e293dd0

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7578256.exe

          Filesize

          175KB

          MD5

          20e0ddd55ed3dc015658737d2eeaf494

          SHA1

          75d92d2a1bb6dc287b81d00a2aed0e41c058f906

          SHA256

          a8a357cb1d84123cf0ccc1945f660cff594900dc7ea14489d392a0556633733a

          SHA512

          e5e7f0c676c8598adb13da85b7879f51ff37bff9abc200accf5ad4d85851b728ff76c423ab459123064cbadf408b33b2d07845fa4ad7f6acde37b0bda96cb557

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1375229.exe

          Filesize

          136KB

          MD5

          fb35c5c86da33ce45453cf6618bbfedb

          SHA1

          c93d8cca5dab3402cfcf59c68c6befe101b8bf7f

          SHA256

          bbc888b7381f3d04c73cf7f81c6c46bf30532ab13f2f2c2531774ac39624a8ac

          SHA512

          4e09207eda58133ca53bd871e51a1d21496596613a9c8f7e6e9a63e913fedb96abc584a91cfdc28c78712dbe2235a83f884b1c26e6cc860be6d6508928c34852

        • memory/1620-61-0x0000000004AF0000-0x0000000004B3C000-memory.dmp

          Filesize

          304KB

        • memory/1620-60-0x00000000075D0000-0x000000000760C000-memory.dmp

          Filesize

          240KB

        • memory/1620-59-0x00000000076A0000-0x00000000077AA000-memory.dmp

          Filesize

          1.0MB

        • memory/1620-58-0x0000000007530000-0x0000000007542000-memory.dmp

          Filesize

          72KB

        • memory/1620-57-0x0000000007AA0000-0x00000000080B8000-memory.dmp

          Filesize

          6.1MB

        • memory/1620-56-0x0000000000810000-0x0000000000838000-memory.dmp

          Filesize

          160KB

        • memory/1932-31-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-20-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-39-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-37-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-35-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-48-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/1932-33-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-43-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-29-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-27-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-25-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-23-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-21-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-41-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-45-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-49-0x000000007465E000-0x000000007465F000-memory.dmp

          Filesize

          4KB

        • memory/1932-50-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/1932-52-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/1932-47-0x0000000002270000-0x0000000002282000-memory.dmp

          Filesize

          72KB

        • memory/1932-19-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/1932-18-0x0000000002270000-0x0000000002288000-memory.dmp

          Filesize

          96KB

        • memory/1932-17-0x0000000004B30000-0x00000000050D4000-memory.dmp

          Filesize

          5.6MB

        • memory/1932-16-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/1932-15-0x00000000021A0000-0x00000000021BA000-memory.dmp

          Filesize

          104KB

        • memory/1932-14-0x000000007465E000-0x000000007465F000-memory.dmp

          Filesize

          4KB