Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:12

General

  • Target

    8cb5d4f3356843f3a3a765ada2ca0e150735cd4ea42ec50356a213d18b6cf4be.exe

  • Size

    480KB

  • MD5

    597872614d29adb76879a8df50d1ac58

  • SHA1

    9be76ab1584199e8cd42826021774271200ae785

  • SHA256

    8cb5d4f3356843f3a3a765ada2ca0e150735cd4ea42ec50356a213d18b6cf4be

  • SHA512

    2471882c2ddfafbb1730a63c4b8e3930d85249607c5cb88c45c4a3f60763b4e540dca9a32afc73d0995f280fbbec61c7b2af48189850efb4cca6a10fbcf6508c

  • SSDEEP

    12288:JMrpy905JxTiDJF31tTecaQ5yzG6GAY9baoKuKpv7N:MyNDzltacaQ5yByaorKvZ

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cb5d4f3356843f3a3a765ada2ca0e150735cd4ea42ec50356a213d18b6cf4be.exe
    "C:\Users\Admin\AppData\Local\Temp\8cb5d4f3356843f3a3a765ada2ca0e150735cd4ea42ec50356a213d18b6cf4be.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1028186.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1028186.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4955834.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4955834.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4068
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2360357.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2360357.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2300

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1028186.exe

          Filesize

          308KB

          MD5

          eee5631352c343dc40f2be59ab1fea39

          SHA1

          de3fa591b3476721f1c5e4f2e359fd06bb19be66

          SHA256

          c185469ebdba5ac411a2ec8cd6fb2fc25cc8d4460fdebedde627d6d441179d55

          SHA512

          b3a8b9fcebc733e5c9d6bc1c87fbd3a056a0df1012eebfb060241e433ca14f46c107a5c0f30386a0c84122016c7448a9b3673991da594f0ef13cc4906234e79d

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4955834.exe

          Filesize

          175KB

          MD5

          3b9f6136f6bcf2d621508b250ddf3387

          SHA1

          1f0250e6ae6d6d875a9f90052d19e23c2b51a831

          SHA256

          30dd51431a4c62feff80417aa76b25f548dd7282bde1f378c5c2ea9af21bcfb9

          SHA512

          849aec70049d095c76f47e59ddef946bac4086125adb41e4094730c8277d5cfeb5660c7fd861a60d61b2101de707684703583a24ffead5cb3f180ca66a2f7a05

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2360357.exe

          Filesize

          136KB

          MD5

          67a1f5c3e7145d19c7b164d02f03813a

          SHA1

          0961355d85ba75511f9e259772d28a96da98b089

          SHA256

          f18ce3331c0500ff1b2d4cfa114fa91a39ba7b92033e81800f8bfaaa78fa1499

          SHA512

          a2fdd7c600541987def2f8a05efc5111467ee6f95eebdf1970140eca0b1c8a4d6fafb1ef5d89cbf91e86cbc8006adcb78dfc911a872b10b17d1003a042afcf44

        • memory/2300-61-0x0000000006E70000-0x0000000006EBC000-memory.dmp

          Filesize

          304KB

        • memory/2300-60-0x0000000006E30000-0x0000000006E6C000-memory.dmp

          Filesize

          240KB

        • memory/2300-59-0x0000000006F00000-0x000000000700A000-memory.dmp

          Filesize

          1.0MB

        • memory/2300-58-0x0000000006D90000-0x0000000006DA2000-memory.dmp

          Filesize

          72KB

        • memory/2300-57-0x0000000007340000-0x0000000007958000-memory.dmp

          Filesize

          6.1MB

        • memory/2300-56-0x0000000000070000-0x0000000000098000-memory.dmp

          Filesize

          160KB

        • memory/4068-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-19-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-48-0x0000000074190000-0x0000000074940000-memory.dmp

          Filesize

          7.7MB

        • memory/4068-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-47-0x0000000074190000-0x0000000074940000-memory.dmp

          Filesize

          7.7MB

        • memory/4068-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-49-0x000000007419E000-0x000000007419F000-memory.dmp

          Filesize

          4KB

        • memory/4068-50-0x0000000074190000-0x0000000074940000-memory.dmp

          Filesize

          7.7MB

        • memory/4068-52-0x0000000074190000-0x0000000074940000-memory.dmp

          Filesize

          7.7MB

        • memory/4068-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

          Filesize

          72KB

        • memory/4068-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

          Filesize

          96KB

        • memory/4068-17-0x0000000004C40000-0x00000000051E4000-memory.dmp

          Filesize

          5.6MB

        • memory/4068-16-0x0000000074190000-0x0000000074940000-memory.dmp

          Filesize

          7.7MB

        • memory/4068-15-0x0000000002150000-0x000000000216A000-memory.dmp

          Filesize

          104KB

        • memory/4068-14-0x000000007419E000-0x000000007419F000-memory.dmp

          Filesize

          4KB