Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:09

General

  • Target

    b448b04ac24d8fea46688845c0727ab3956f2782a0f95b76e1a515d220087044.exe

  • Size

    936KB

  • MD5

    b73e5752ac0ba793c7b1d21672663870

  • SHA1

    30fde319691396fbfccc4daa6436d968e7502bc5

  • SHA256

    b448b04ac24d8fea46688845c0727ab3956f2782a0f95b76e1a515d220087044

  • SHA512

    9e270c68ba259464fe298ff656b3fdb8cea86eb194aa045d4442425b9b21dbd81bae7b924d090b05a48d7e7d6d44c00f26355e7d3d39a112313260d2772c3869

  • SSDEEP

    12288:Ay90GtLj+X5ZWvvHtvtP4ys6VmTThDCdF63rjqgKepgVlyOt/WtDwFdh:AyFtLKivKyhmTTtYe6VlyOKMx

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b448b04ac24d8fea46688845c0727ab3956f2782a0f95b76e1a515d220087044.exe
    "C:\Users\Admin\AppData\Local\Temp\b448b04ac24d8fea46688845c0727ab3956f2782a0f95b76e1a515d220087044.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisT5017.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisT5017.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zini9845.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zini9845.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4148
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it676378.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it676378.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1376
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr838012.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr838012.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:540

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisT5017.exe

          Filesize

          623KB

          MD5

          185e05bfc6f1566b6f97026e13c481df

          SHA1

          9cdb90cca9450187511e75a8e73846a1c67515a9

          SHA256

          b915492254f92a219e82c5090175d6e999ec6ab1f803cd60589f8885cf5b49a0

          SHA512

          f0cd449446095a16ed54ad456726010456959c3537df74a555aeb40babf9dcade7153437c782f47752a44089a1d4ac68fbc68f080a8bc1ad202e726a22d04870

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zini9845.exe

          Filesize

          469KB

          MD5

          5f4f29c3efdad32b784f2804e42eb4b7

          SHA1

          2c4167a3063afdd6de18171a3b03f133a9c2e87f

          SHA256

          99e4fe8c54bfe4354630158d849c62214a283baf17475fec5dd21c0e89a085bb

          SHA512

          930309ad4daa81d6099041ea5e0ada3a22f6d57141efa620dad2c5cf064e8fe499cca439b9c1f0d0ba3303b70b3db9824a8425ad2cc40d9254a279e6c82ac8da

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it676378.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr838012.exe

          Filesize

          485KB

          MD5

          5f77a9c86c224db23845efdb2cd5e8ab

          SHA1

          2d912178f745bb5745c6d3dc57b7c6328964a964

          SHA256

          26be89aae8b9e08e63548ba9f145185d31256fea0a7328831a786fa4e1a4e4c3

          SHA512

          6781904b392fe6505b028d3bfe1d86504436dfd04139d8bbf5a9e0f3b0fdfa63b911f6ad302de84e428259eb6d3a6bf38eaacba8ea51c7917483afe248079608

        • memory/540-71-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-43-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-828-0x00000000027C0000-0x000000000280C000-memory.dmp

          Filesize

          304KB

        • memory/540-29-0x00000000026F0000-0x000000000272C000-memory.dmp

          Filesize

          240KB

        • memory/540-30-0x0000000004F50000-0x00000000054F4000-memory.dmp

          Filesize

          5.6MB

        • memory/540-31-0x0000000004E30000-0x0000000004E6A000-memory.dmp

          Filesize

          232KB

        • memory/540-47-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-63-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-95-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-93-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-89-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-87-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-85-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-83-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-824-0x0000000007980000-0x0000000007F98000-memory.dmp

          Filesize

          6.1MB

        • memory/540-81-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-79-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-77-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-75-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-73-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-65-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-827-0x00000000080E0000-0x000000000811C000-memory.dmp

          Filesize

          240KB

        • memory/540-69-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-61-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-59-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-58-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-55-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-53-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-51-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-49-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-45-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-826-0x0000000007FC0000-0x00000000080CA000-memory.dmp

          Filesize

          1.0MB

        • memory/540-41-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-39-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-91-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-67-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-37-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-35-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-33-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-32-0x0000000004E30000-0x0000000004E65000-memory.dmp

          Filesize

          212KB

        • memory/540-825-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/1376-21-0x00007FF908AD3000-0x00007FF908AD5000-memory.dmp

          Filesize

          8KB

        • memory/1376-23-0x00007FF908AD3000-0x00007FF908AD5000-memory.dmp

          Filesize

          8KB

        • memory/1376-22-0x0000000000B80000-0x0000000000B8A000-memory.dmp

          Filesize

          40KB