Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:09

General

  • Target

    9fde087367c2d8d1e42603bf60066eb7a7989f85f9a109bd3503bb81b1d2b0ee.exe

  • Size

    642KB

  • MD5

    71c5c17e2b3996d9665bb891394dc61e

  • SHA1

    5c98136407fbde573108290f8dea533f48f012fe

  • SHA256

    9fde087367c2d8d1e42603bf60066eb7a7989f85f9a109bd3503bb81b1d2b0ee

  • SHA512

    84210685237d4e75a3f954ae69c022e20d9f5dac4207031781a6eb60b26e25e033ab3072d2d772dba1f184afc825489ab2b35526cd142727825afd86ae8850ec

  • SSDEEP

    12288:3y90hssoBqe2VblPMYlktR1ATNn+k6wvioLEzyOKRYzigAq:3yk2kHbBlG1Ap4oLsygLAq

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9fde087367c2d8d1e42603bf60066eb7a7989f85f9a109bd3503bb81b1d2b0ee.exe
    "C:\Users\Admin\AppData\Local\Temp\9fde087367c2d8d1e42603bf60066eb7a7989f85f9a109bd3503bb81b1d2b0ee.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st517171.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st517171.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\61786627.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\61786627.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3880
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp127099.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp127099.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1820
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:228

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st517171.exe

          Filesize

          488KB

          MD5

          559ade812b4be58df5d5134c3efefbd3

          SHA1

          c5521ecc4d46b80e7aa3ecfa7aac9b272d5f98f1

          SHA256

          1c1bfb42c443a1a989ce5c44cf4121d30e579f1e8d517f0d8fe03bfc45aba7a5

          SHA512

          3f30e1cbeeaa46b8930dde9e064f0380069c1dbed186929c3db5bdf4c9c93f2f138d2987d4dd03d1fbba93a408ee2a6f1cbc9d2753c7e4f175fe9e1ee77a12dd

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\61786627.exe

          Filesize

          176KB

          MD5

          2b71f4b18ac8214a2bff547b6ce2f64f

          SHA1

          b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

          SHA256

          f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

          SHA512

          33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp127099.exe

          Filesize

          340KB

          MD5

          3b995ebf43941b8e36e7d510c45d1e93

          SHA1

          0547f65441345cff047c718a99147aed621b4c5a

          SHA256

          b1714d9518edccd93625584dc847533d4be21bfb5f364c380477a87a9885c188

          SHA512

          7916870e964a58f3db7ccbe2cbbb86cb0816a61ba25955c549094dd2f7d961d407c0d358d53ca5a0615273e5cee8d3aca2781350100170d911167fecb77d3b47

        • memory/1820-86-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-92-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-852-0x000000000A330000-0x000000000A342000-memory.dmp

          Filesize

          72KB

        • memory/1820-851-0x0000000009C70000-0x000000000A288000-memory.dmp

          Filesize

          6.1MB

        • memory/1820-72-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-76-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-78-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-80-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-82-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-84-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-854-0x000000000A470000-0x000000000A4AC000-memory.dmp

          Filesize

          240KB

        • memory/1820-58-0x0000000007190000-0x00000000071CA000-memory.dmp

          Filesize

          232KB

        • memory/1820-90-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-853-0x000000000A350000-0x000000000A45A000-memory.dmp

          Filesize

          1.0MB

        • memory/1820-94-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-59-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-60-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-62-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-64-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-74-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-88-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-68-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-70-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-66-0x0000000007190000-0x00000000071C5000-memory.dmp

          Filesize

          212KB

        • memory/1820-855-0x000000000A5F0000-0x000000000A63C000-memory.dmp

          Filesize

          304KB

        • memory/1820-57-0x00000000049E0000-0x0000000004A1C000-memory.dmp

          Filesize

          240KB

        • memory/3880-41-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-52-0x0000000074080000-0x0000000074830000-memory.dmp

          Filesize

          7.7MB

        • memory/3880-50-0x0000000074080000-0x0000000074830000-memory.dmp

          Filesize

          7.7MB

        • memory/3880-49-0x000000007408E000-0x000000007408F000-memory.dmp

          Filesize

          4KB

        • memory/3880-48-0x0000000074080000-0x0000000074830000-memory.dmp

          Filesize

          7.7MB

        • memory/3880-20-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-21-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-23-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-25-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-29-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-31-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-35-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-37-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-39-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-43-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-45-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-47-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-33-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-27-0x00000000023A0000-0x00000000023B3000-memory.dmp

          Filesize

          76KB

        • memory/3880-19-0x0000000074080000-0x0000000074830000-memory.dmp

          Filesize

          7.7MB

        • memory/3880-18-0x00000000023A0000-0x00000000023B8000-memory.dmp

          Filesize

          96KB

        • memory/3880-17-0x0000000004AB0000-0x0000000005054000-memory.dmp

          Filesize

          5.6MB

        • memory/3880-16-0x0000000074080000-0x0000000074830000-memory.dmp

          Filesize

          7.7MB

        • memory/3880-15-0x00000000021A0000-0x00000000021BA000-memory.dmp

          Filesize

          104KB

        • memory/3880-14-0x000000007408E000-0x000000007408F000-memory.dmp

          Filesize

          4KB