Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 05:16

General

  • Target

    0f2cdc4bd0d044a85991be35423016fb908064b0882c5b617e6a762f35571443.exe

  • Size

    569KB

  • MD5

    05306fee83e21142a466bd26494560a9

  • SHA1

    a5e87626f1cdbaa84fd7d190d1303888d7a541fb

  • SHA256

    0f2cdc4bd0d044a85991be35423016fb908064b0882c5b617e6a762f35571443

  • SHA512

    a13dc59f0b252d41b3e4c2ddce3b819419bffef1e89c82e36b11b0271e2676f32d7e46a865706b8af201c666505c3e8b95b3aa34f138b5169c125b0fe61c9635

  • SSDEEP

    12288:Iy90VwsY7UVNtUJ7wnrPwwmuOdz3/ubDp9X1vtEeqqxtgy/xu/I:IyyhNtYcrI9uOdz2t9X1vqDyz5z

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 36 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f2cdc4bd0d044a85991be35423016fb908064b0882c5b617e6a762f35571443.exe
    "C:\Users\Admin\AppData\Local\Temp\0f2cdc4bd0d044a85991be35423016fb908064b0882c5b617e6a762f35571443.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipL3995.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipL3995.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it946364.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it946364.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1760
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp996011.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp996011.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1392

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipL3995.exe

          Filesize

          414KB

          MD5

          d8d013ab1c2e940cd080c154915b588c

          SHA1

          56e23f37ae7bed30f0aa17e6b49a966d45550a1b

          SHA256

          c532b314c5c9bd1df441b8896c0771b08a9765db54df12da3aea0f25dd9eafaa

          SHA512

          169927337859868807d713be5132899e671f17edd5ca667df6321df706e29bf291803055c18cfb37afe0ed0b01103d57c6905782b99c0d318e5f43b0ba991585

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it946364.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp996011.exe

          Filesize

          381KB

          MD5

          54f69fc39faf5df119404af29103dde6

          SHA1

          7fb3c05efb99871c7d8fe94a4454b04871ff6041

          SHA256

          9dd8b6b77f8da4cde24aae39b44920292b93984c6b61a504eed1e3d8d1cc54a0

          SHA512

          782b02625149ccc10776cc94f0157388947b3703b41eba03e0347f18ff677a25ee7984fbbbfd9bab9bea507222a94fdf4d5a5dc4ea317cc7ef9a248ddfee2ffd

        • memory/1392-58-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-72-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-821-0x0000000004DC0000-0x0000000004E0C000-memory.dmp

          Filesize

          304KB

        • memory/1392-22-0x0000000004D60000-0x0000000004D9C000-memory.dmp

          Filesize

          240KB

        • memory/1392-23-0x00000000073D0000-0x0000000007974000-memory.dmp

          Filesize

          5.6MB

        • memory/1392-24-0x00000000072F0000-0x000000000732A000-memory.dmp

          Filesize

          232KB

        • memory/1392-42-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-50-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-88-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-84-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-82-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-80-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-78-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-48-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-74-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-52-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-70-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-66-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-64-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-62-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-60-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-820-0x000000000A5E0000-0x000000000A61C000-memory.dmp

          Filesize

          240KB

        • memory/1392-819-0x000000000A4B0000-0x000000000A5BA000-memory.dmp

          Filesize

          1.0MB

        • memory/1392-54-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-76-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-46-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-44-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-40-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-39-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-36-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-37-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-34-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-32-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-30-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-86-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-68-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-56-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-28-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-26-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-25-0x00000000072F0000-0x0000000007325000-memory.dmp

          Filesize

          212KB

        • memory/1392-817-0x0000000009E00000-0x000000000A418000-memory.dmp

          Filesize

          6.1MB

        • memory/1392-818-0x000000000A490000-0x000000000A4A2000-memory.dmp

          Filesize

          72KB

        • memory/1760-16-0x00007FFB2FE73000-0x00007FFB2FE75000-memory.dmp

          Filesize

          8KB

        • memory/1760-14-0x00007FFB2FE73000-0x00007FFB2FE75000-memory.dmp

          Filesize

          8KB

        • memory/1760-15-0x0000000000690000-0x000000000069A000-memory.dmp

          Filesize

          40KB