Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 06:05

General

  • Target

    80f08ddcf129233f3731597c5ef6c6a2abf805a0d62727ec1db7a1a73e21ce29.exe

  • Size

    829KB

  • MD5

    2ce5496eb967fad94a799d81ad8df38b

  • SHA1

    2ac400538285cf724f5e7fa6bc92f8d7e9685ff2

  • SHA256

    80f08ddcf129233f3731597c5ef6c6a2abf805a0d62727ec1db7a1a73e21ce29

  • SHA512

    2e00075f0e44533666c7996d3ad5d3f80f03a3b18cbfc8607611c9a31e1909b69357685f601516c3e998497ec7c4fb99b141767558be4943ec01eb194bcfba55

  • SSDEEP

    12288:ryy90SNx1F0GzCgRiDW7HSb9ZwQlnQ71QcdE4cY8X0SHdFGOO9kvuAiPQZpSwQdf:myZCxW7HKJiXE40Xl9tvuk3w

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80f08ddcf129233f3731597c5ef6c6a2abf805a0d62727ec1db7a1a73e21ce29.exe
    "C:\Users\Admin\AppData\Local\Temp\80f08ddcf129233f3731597c5ef6c6a2abf805a0d62727ec1db7a1a73e21ce29.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixF5543.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixF5543.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziVV4042.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziVV4042.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it268785.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it268785.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3652
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr778736.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr778736.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1324

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixF5543.exe

          Filesize

          569KB

          MD5

          f9b3900bca5fba8f1db8110c8a307fbf

          SHA1

          3259263ca35ed2f0333e5fe4cd52b452756eecae

          SHA256

          f2459e922b35b5383904f40ca49673a28fbabfdb022c5f8fecf9b5dbbaccb135

          SHA512

          de2583af116cc7ced74688395f66aac878bfd1eebc97999a7320d6911375928474ebf7af564b13190b99fd63c9cb5ab6e07ca91063ac0fa49797cca9e3f1d222

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziVV4042.exe

          Filesize

          415KB

          MD5

          80bda0befe6522219cf54e1712667df0

          SHA1

          b7a23a0791774cfb61e83d479ccf1efad8a1ebee

          SHA256

          a654b4ef8483e18c4f895fc4f1b01b52fe497a622a63362ceef84e1e4ddc34ae

          SHA512

          64d03ce2e3d57748748fe9fc54793102b997ad0016a4456045ea94d8b09707824500dbb32065f675d0e28255e8da5024d458e8090ef4d5255d4635c067cba15c

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it268785.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr778736.exe

          Filesize

          382KB

          MD5

          b53e080ca68c735765074046852f942f

          SHA1

          74341dd2807c016e16031b3190a2929a3e5618bb

          SHA256

          ff28224b737f5002b6f9f2697a5720b03cec248b05fce52e7efe19286ce322db

          SHA512

          56de6f945054a67ed2737ed9940e70f970a81ffee22b1d908824b7bf75e6f9e7b9dfc8adf17221ac5a570be62acbec22b1d0ae955e8ad42046a9132d2d6a508a

        • memory/1324-69-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-41-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-828-0x0000000004BD0000-0x0000000004C1C000-memory.dmp

          Filesize

          304KB

        • memory/1324-29-0x0000000004A30000-0x0000000004A6C000-memory.dmp

          Filesize

          240KB

        • memory/1324-30-0x00000000073C0000-0x0000000007964000-memory.dmp

          Filesize

          5.6MB

        • memory/1324-31-0x00000000071E0000-0x000000000721A000-memory.dmp

          Filesize

          232KB

        • memory/1324-37-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-47-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-95-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-93-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-91-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-89-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-85-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-83-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-81-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-79-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-77-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-75-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-73-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-71-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-63-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-827-0x000000000A4A0000-0x000000000A4DC000-memory.dmp

          Filesize

          240KB

        • memory/1324-65-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-62-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-57-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-55-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-54-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-52-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-49-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-45-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-43-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-826-0x000000000A370000-0x000000000A47A000-memory.dmp

          Filesize

          1.0MB

        • memory/1324-39-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-87-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-67-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-59-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-35-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-33-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-32-0x00000000071E0000-0x0000000007215000-memory.dmp

          Filesize

          212KB

        • memory/1324-824-0x0000000009CF0000-0x000000000A308000-memory.dmp

          Filesize

          6.1MB

        • memory/1324-825-0x000000000A350000-0x000000000A362000-memory.dmp

          Filesize

          72KB

        • memory/3652-21-0x00007FFFAD523000-0x00007FFFAD525000-memory.dmp

          Filesize

          8KB

        • memory/3652-23-0x00007FFFAD523000-0x00007FFFAD525000-memory.dmp

          Filesize

          8KB

        • memory/3652-22-0x0000000000B90000-0x0000000000B9A000-memory.dmp

          Filesize

          40KB