Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:16

General

  • Target

    e12cebf99ff536231ee015e3aebe854d3b37426ba944f3947c76bd37fcb770ef.exe

  • Size

    611KB

  • MD5

    9c77d13c19d45847bbc6674d1436c94c

  • SHA1

    3d9c508031248b862b8893ef37721b5cbbbe1e6d

  • SHA256

    e12cebf99ff536231ee015e3aebe854d3b37426ba944f3947c76bd37fcb770ef

  • SHA512

    3bd76a5e4349019d1943557f724cb844b69b52a41a740045bdef746e711bc7ffa7b0a3da767ed884827887440c7409021d6b83d1bcb432bb35f10e1d9316e988

  • SSDEEP

    12288:Dy90BRfZ4hftNsa70rqEQiszG4gNZbPjA4MaFSMnueRYRdMShvkEU38k10XNe3IK:Dy2Rh4hlL70GEQFXmbPjzhC9HrkEa8Eh

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e12cebf99ff536231ee015e3aebe854d3b37426ba944f3947c76bd37fcb770ef.exe
    "C:\Users\Admin\AppData\Local\Temp\e12cebf99ff536231ee015e3aebe854d3b37426ba944f3947c76bd37fcb770ef.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st217114.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st217114.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\74630165.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\74630165.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4508
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp109025.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp109025.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3652

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st217114.exe

          Filesize

          457KB

          MD5

          072ef5d417711198df6a3541ae1e7384

          SHA1

          bd9decabaee327358b449a9a5b5f4e32f809c0d0

          SHA256

          37d903ce9c99f71bc5d43d1b9c9748acf6acdf94e59bce2aaf90fd2f9ae8ce1f

          SHA512

          9bec7ada0f92c0fa349297d3369e1136df157acbcdfc9166d315ebc817a9341435f3fc15182f8021454546ccb322c138aedecad65bd23a88d90b3f4c4b2d7980

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\74630165.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp109025.exe

          Filesize

          460KB

          MD5

          647df8831099a8f0bfc8b3a1a4060ab1

          SHA1

          b93726bec7ccb6bf3bcd155dc03fa31ada531b99

          SHA256

          efe096274b02d67e98c9b2f289e006f3649780a33a2204ed2eb87208bf6b56d9

          SHA512

          0801363bcb94b9fcbf481d0fffe3c965b4236ca4216d746f7eb9d6a748d137db0519082b4badbc46d2d4ea1017125a9bf1a8b89edde717a4d06e87ba932f53db

        • memory/3652-62-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-70-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-821-0x0000000002790000-0x00000000027DC000-memory.dmp

          Filesize

          304KB

        • memory/3652-22-0x00000000024F0000-0x000000000252C000-memory.dmp

          Filesize

          240KB

        • memory/3652-23-0x0000000005010000-0x00000000055B4000-memory.dmp

          Filesize

          5.6MB

        • memory/3652-24-0x00000000028A0000-0x00000000028DA000-memory.dmp

          Filesize

          232KB

        • memory/3652-34-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-86-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-88-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-84-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-82-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-80-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-78-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-76-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-74-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-72-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-68-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-66-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-64-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-820-0x00000000080E0000-0x000000000811C000-memory.dmp

          Filesize

          240KB

        • memory/3652-54-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-819-0x0000000007FC0000-0x00000000080CA000-memory.dmp

          Filesize

          1.0MB

        • memory/3652-56-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-52-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-50-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-48-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-46-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-42-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-40-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-38-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-36-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-58-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-60-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-44-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-32-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-30-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-28-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-26-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-25-0x00000000028A0000-0x00000000028D5000-memory.dmp

          Filesize

          212KB

        • memory/3652-817-0x0000000007940000-0x0000000007F58000-memory.dmp

          Filesize

          6.1MB

        • memory/3652-818-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/4508-16-0x00007FFDD2593000-0x00007FFDD2595000-memory.dmp

          Filesize

          8KB

        • memory/4508-14-0x00007FFDD2593000-0x00007FFDD2595000-memory.dmp

          Filesize

          8KB

        • memory/4508-15-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

          Filesize

          40KB