Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:11

General

  • Target

    cf88a38d8b6db6c29ced2513b6b0560c44c68323bffdc64d54583b7b6930f04a.exe

  • Size

    569KB

  • MD5

    9eb0775eeee9a4803785961dfc8fe3be

  • SHA1

    ec2eefe1dd1b3d68153f9bfaa027e4a6542a78bd

  • SHA256

    cf88a38d8b6db6c29ced2513b6b0560c44c68323bffdc64d54583b7b6930f04a

  • SHA512

    701c623e4e201687a906770a3caa7ff06a32eca72f273f3092a268d1acd0d0c5ea899a99b40b2dae103e0e61b7ba7094b764bbffa037676318df10a5096c2f84

  • SSDEEP

    12288:ey90aVOGiyg6wnzfhkG1wRXKOh2O6/0p8PnZnfS34/thxwK:eyfXib7nzfN1IUPnpfmM7xwK

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf88a38d8b6db6c29ced2513b6b0560c44c68323bffdc64d54583b7b6930f04a.exe
    "C:\Users\Admin\AppData\Local\Temp\cf88a38d8b6db6c29ced2513b6b0560c44c68323bffdc64d54583b7b6930f04a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipP4958.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipP4958.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it619959.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it619959.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:476
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp166890.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp166890.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1552

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipP4958.exe

          Filesize

          414KB

          MD5

          2fd596e08b11d83e0fa618267f13cbc2

          SHA1

          d4649858cf43913d709f4eb90fb52936f24e1fbb

          SHA256

          c0d65046fa71dca488320b405a4bf6536a396d19d5f28d5ac0595c9d092ecdef

          SHA512

          a346e9b43d3e035757200f7cbf0766a91dcca869bf9866155db31b85513738524c4ff7e8b7508ffa85e588d5796591d8cc45e1324db713ee87fa0ddce4c72e48

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it619959.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp166890.exe

          Filesize

          362KB

          MD5

          cf7f990663d1314571f266e36e46d2cb

          SHA1

          231ca14b41683379e3c743531edaebdd9b6955ac

          SHA256

          c0ef99140244788620f769b899d5d603482598011a8d971ae9c6b0c89a151cfd

          SHA512

          7ed9288cbe4b342d228665a782f1df6a1111859f6e1c3e8854eef05aa3e51544d3c753687ab6ed3b26e24c5fea76f3c8e78e23acaee461956e752f0685269a30

        • memory/476-14-0x00007FFE4C513000-0x00007FFE4C515000-memory.dmp

          Filesize

          8KB

        • memory/476-15-0x0000000000120000-0x000000000012A000-memory.dmp

          Filesize

          40KB

        • memory/476-16-0x00007FFE4C513000-0x00007FFE4C515000-memory.dmp

          Filesize

          8KB

        • memory/1552-78-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-66-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-24-0x0000000004B90000-0x0000000004BCA000-memory.dmp

          Filesize

          232KB

        • memory/1552-30-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-34-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-32-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-76-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-48-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-28-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-26-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-25-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-88-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-86-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-84-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-82-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-80-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-22-0x0000000004AF0000-0x0000000004B2C000-memory.dmp

          Filesize

          240KB

        • memory/1552-74-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-72-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-70-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-69-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-23-0x00000000072C0000-0x0000000007864000-memory.dmp

          Filesize

          5.6MB

        • memory/1552-64-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-62-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-60-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-58-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-56-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-54-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-52-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-50-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-46-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-44-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-42-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-40-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-38-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-36-0x0000000004B90000-0x0000000004BC5000-memory.dmp

          Filesize

          212KB

        • memory/1552-817-0x0000000009CF0000-0x000000000A308000-memory.dmp

          Filesize

          6.1MB

        • memory/1552-818-0x000000000A350000-0x000000000A362000-memory.dmp

          Filesize

          72KB

        • memory/1552-819-0x000000000A370000-0x000000000A47A000-memory.dmp

          Filesize

          1.0MB

        • memory/1552-820-0x000000000A490000-0x000000000A4CC000-memory.dmp

          Filesize

          240KB

        • memory/1552-821-0x0000000004A60000-0x0000000004AAC000-memory.dmp

          Filesize

          304KB