Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:05

General

  • Target

    8ddfdda1be4f4c4edccd33ddf9dfd7356d69a7da680f3254480ccc1a513621de.exe

  • Size

    919KB

  • MD5

    aa9ee0550f42f4a7875efa4ff33dc7b7

  • SHA1

    f1d39b41ec9c5b4aba312340eb9715dbfd7135be

  • SHA256

    8ddfdda1be4f4c4edccd33ddf9dfd7356d69a7da680f3254480ccc1a513621de

  • SHA512

    1b9488bbb95f38c0a3cc5a26468f43e74e066447b6f9dea9ba53ea4fa301a21203e6a8f60186ffb3bebaacea1b8dd58ded839b66ae1e5cca67eb280b4c856e3e

  • SSDEEP

    24576:aymK41zZDbDUMw5CkKApOcu1CD7yraWvN9Ag/vgS:hmK4BZm5pMwGGWVyav

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ddfdda1be4f4c4edccd33ddf9dfd7356d69a7da680f3254480ccc1a513621de.exe
    "C:\Users\Admin\AppData\Local\Temp\8ddfdda1be4f4c4edccd33ddf9dfd7356d69a7da680f3254480ccc1a513621de.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyP1138.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyP1138.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:488
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwi3622.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwi3622.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it969266.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it969266.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4408
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr235115.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr235115.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1060

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyP1138.exe

          Filesize

          615KB

          MD5

          7337762c71740c5a1e8019a69aa7199f

          SHA1

          6732cf630f5261655177c98623a8f08985cc2f39

          SHA256

          80625a7d1130ad689617e17ab7fb18d549f7961b5b57964b5429efbf1b48792c

          SHA512

          317da8f83c2294da582da5a85a5b939b55455401787dec1d941f63e9e468a7f9e94bcaa4f0b86f8a6164bb3c51d22b60cca712ef3a9ada6a34c682fdae3b48e9

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziwi3622.exe

          Filesize

          461KB

          MD5

          2da312b6916121f5f0d08872de72700b

          SHA1

          6796d2a96b9964001f7590b9081bd57c6d151af6

          SHA256

          36404d43375645160133a80b6216d3d2c67e9bdc540dcafe548f5dbe30b8fbbe

          SHA512

          3568eb36ecf7617b67abd54a0dbf037b34b6a00bf00d3a92d8caa4ed2b0bb56aa4cde719f2eed5942d355e9d44714b97ac9bd89f82b7b35cb2bf6a47ee8f92a7

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it969266.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr235115.exe

          Filesize

          472KB

          MD5

          8758ea48d228c095fd9075b58bbbc6d3

          SHA1

          ee04909b6730175436632370503912ca28b1ef8d

          SHA256

          72376ce230cb7e1d4dc14881aa8fcd14344715a70384a184756dc51a0e74d45c

          SHA512

          0f91913430db94f8a05b0a41170ccf766f412f56ea80dabeaf1fe243e2bbf860318c0defc4ea5c39dfc219ff41758819cf1f23b3c2d2c26e3e93935db24cc8b9

        • memory/1060-91-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-65-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-828-0x0000000004950000-0x000000000499C000-memory.dmp

          Filesize

          304KB

        • memory/1060-29-0x00000000027A0000-0x00000000027DC000-memory.dmp

          Filesize

          240KB

        • memory/1060-30-0x0000000005010000-0x00000000055B4000-memory.dmp

          Filesize

          5.6MB

        • memory/1060-31-0x0000000004E60000-0x0000000004E9A000-memory.dmp

          Filesize

          232KB

        • memory/1060-45-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-47-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-43-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-41-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-39-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-93-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-81-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-70-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-57-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-37-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-35-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-33-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-32-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-95-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-87-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-49-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-89-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-85-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-83-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-79-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-77-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-75-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-73-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-71-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-67-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-51-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-63-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-826-0x0000000007FC0000-0x00000000080CA000-memory.dmp

          Filesize

          1.0MB

        • memory/1060-827-0x00000000080E0000-0x000000000811C000-memory.dmp

          Filesize

          240KB

        • memory/1060-825-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/1060-824-0x0000000007940000-0x0000000007F58000-memory.dmp

          Filesize

          6.1MB

        • memory/1060-61-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-59-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-55-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/1060-53-0x0000000004E60000-0x0000000004E95000-memory.dmp

          Filesize

          212KB

        • memory/4408-21-0x00007FFC6DCE3000-0x00007FFC6DCE5000-memory.dmp

          Filesize

          8KB

        • memory/4408-23-0x00007FFC6DCE3000-0x00007FFC6DCE5000-memory.dmp

          Filesize

          8KB

        • memory/4408-22-0x0000000000CB0000-0x0000000000CBA000-memory.dmp

          Filesize

          40KB