Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 06:04

General

  • Target

    9863c6fa15bf0562549cda9afdd242fc6d7918f57827e23e5e0e99ff0de5fbb4.exe

  • Size

    479KB

  • MD5

    0eaa95f90f701285dfe9305882f8a0be

  • SHA1

    b1f62ce37faf8ce81a7e9c7128f230de976777e1

  • SHA256

    9863c6fa15bf0562549cda9afdd242fc6d7918f57827e23e5e0e99ff0de5fbb4

  • SHA512

    4e5b3d7fa40f43853052f3f382fb103e4c079dee588ae4363159b78658c9e645ead8cc5f51f2054294457ee91b30fb930f4f585e4860e0da152a5e45af8f0bcd

  • SSDEEP

    12288:jMrOy90jupW1TBG7Ofg5c1u31ITVi2mQbWfpcCKnItq:ty0upWPUXGTU2RspcVnMq

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9863c6fa15bf0562549cda9afdd242fc6d7918f57827e23e5e0e99ff0de5fbb4.exe
    "C:\Users\Admin\AppData\Local\Temp\9863c6fa15bf0562549cda9afdd242fc6d7918f57827e23e5e0e99ff0de5fbb4.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1004412.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1004412.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4072409.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4072409.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3836
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4559795.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4559795.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3004
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:3540

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1004412.exe

          Filesize

          307KB

          MD5

          be4076aaef13f93001191616db9fb911

          SHA1

          4e2838ddd16aa62bba272f55ddc818ecc6bc8aad

          SHA256

          618c15f9cd45d09d0563e0e039c2ec2d82eb591396507340977640378b909c62

          SHA512

          75d5a1b02ff2c01ddd4f210c6872e726ea8eb90b26f4e74565b672e69528811406189787c01ecf11e45e810b798d15495836fd58c8c303b8be97a6ec57c0d0ac

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4072409.exe

          Filesize

          175KB

          MD5

          94c4b7c1ecd667b2f1bd7cd29ad058be

          SHA1

          c2368dc9b57a072f37ff2cf0af7b77e85906a7c5

          SHA256

          67ef6b64cf0d4dea215b300b4840b53ad669a731fd73fa3be2ba74ca8ca212c4

          SHA512

          8d819b023c85e74cd72bd02c6f4b66bc057ce1da706d0dad9fec1627eb75caa04c00d51a675780a5b3727fb08ab92f1f2f3747e2529bc83e0ad96e882a5e0c3d

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4559795.exe

          Filesize

          136KB

          MD5

          14def87e3ed710cf7f2ae77e4b9ac277

          SHA1

          724a6d605b16ebbef3a265fccfceebb2528595bc

          SHA256

          2c101da78a25d8760c6b7a3693845afe22e815ccbd1be9c2ae7729d45efd0b75

          SHA512

          69f022575fb9b7227d4863869c908937824ea754a568c570769467b683c313c76e845a0b2a368f4b82606ddf1b6e49a49c1b2ed08b065273dbf7e317a25f488d

        • memory/3004-61-0x00000000043A0000-0x00000000043EC000-memory.dmp

          Filesize

          304KB

        • memory/3004-60-0x0000000006FB0000-0x0000000006FEC000-memory.dmp

          Filesize

          240KB

        • memory/3004-59-0x0000000007060000-0x000000000716A000-memory.dmp

          Filesize

          1.0MB

        • memory/3004-58-0x0000000006EF0000-0x0000000006F02000-memory.dmp

          Filesize

          72KB

        • memory/3004-57-0x0000000007450000-0x0000000007A68000-memory.dmp

          Filesize

          6.1MB

        • memory/3004-56-0x00000000001D0000-0x00000000001F8000-memory.dmp

          Filesize

          160KB

        • memory/3836-35-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-21-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-43-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-41-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-39-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-48-0x00000000740A0000-0x0000000074850000-memory.dmp

          Filesize

          7.7MB

        • memory/3836-37-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-47-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-33-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-31-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-27-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-25-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-23-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-45-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-20-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-49-0x00000000740AE000-0x00000000740AF000-memory.dmp

          Filesize

          4KB

        • memory/3836-50-0x00000000740A0000-0x0000000074850000-memory.dmp

          Filesize

          7.7MB

        • memory/3836-52-0x00000000740A0000-0x0000000074850000-memory.dmp

          Filesize

          7.7MB

        • memory/3836-29-0x0000000002430000-0x0000000002442000-memory.dmp

          Filesize

          72KB

        • memory/3836-19-0x00000000740A0000-0x0000000074850000-memory.dmp

          Filesize

          7.7MB

        • memory/3836-18-0x0000000002430000-0x0000000002448000-memory.dmp

          Filesize

          96KB

        • memory/3836-16-0x00000000740A0000-0x0000000074850000-memory.dmp

          Filesize

          7.7MB

        • memory/3836-17-0x0000000004B00000-0x00000000050A4000-memory.dmp

          Filesize

          5.6MB

        • memory/3836-15-0x00000000021B0000-0x00000000021CA000-memory.dmp

          Filesize

          104KB

        • memory/3836-14-0x00000000740AE000-0x00000000740AF000-memory.dmp

          Filesize

          4KB