Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:15

General

  • Target

    709c8b0e42f5b5aa8680ed2a282050ac38b674b56d129b6f4556c1b03c71114b.exe

  • Size

    569KB

  • MD5

    a55ad780a28cc165a631172103b17b8f

  • SHA1

    b0aff864cffdd89c264a89248383a33d06c4a7d5

  • SHA256

    709c8b0e42f5b5aa8680ed2a282050ac38b674b56d129b6f4556c1b03c71114b

  • SHA512

    0571ad6bc236e5822119f91641f3f8752b1466b31c7aa905b64c44b44e59d875e21b056eba2d2d78c84d152f9bf2ca75c481f4cd7049f57ad117899c43411ed0

  • SSDEEP

    12288:my90QPKhD76OygMBzs0UaF5dXnRY8L0LTz5A0FL1c6uK+wv:mybPoPByBoFaxXnbLYlddXv

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\709c8b0e42f5b5aa8680ed2a282050ac38b674b56d129b6f4556c1b03c71114b.exe
    "C:\Users\Admin\AppData\Local\Temp\709c8b0e42f5b5aa8680ed2a282050ac38b674b56d129b6f4556c1b03c71114b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRH8945.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRH8945.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4192
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it020675.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it020675.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp203509.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp203509.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5016
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:4844

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRH8945.exe

          Filesize

          415KB

          MD5

          26cf74ca71d9bdd291d7ae2b8e744315

          SHA1

          0f7d1a9a9add2c1eea6e33888b8f62399f42307f

          SHA256

          dc782ec21567fa4db46454ec7d6cd22390f7cf67bd27283506831c07a872d025

          SHA512

          4f1decf41aca59dc10cd1c555d7bcee3c9ecdd8e91b9a66797226fc21400dfaf09515c2880589523d2c13ebab9d5f6b6495fb996e2cb87f777fc739d68c331d9

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it020675.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp203509.exe

          Filesize

          382KB

          MD5

          5d9157b474a4f07123cfce2ea6073788

          SHA1

          dfeaa48087897b039fc2bdfda25c9f76067de898

          SHA256

          97816aa5dead7ca4cbd4001627d949ec85812cf6208c41c123931613a51c4332

          SHA512

          0e9e6e0e1bba2591f029bc56b83c7d5c1168e4ba5c81ea71f1e6b13854002b13793bdd321799c8da384bfe2e75001a2ae985904da74673a2865eb8fa1742fd7c

        • memory/2364-14-0x00007FFE3CE33000-0x00007FFE3CE35000-memory.dmp

          Filesize

          8KB

        • memory/2364-15-0x0000000000D40000-0x0000000000D4A000-memory.dmp

          Filesize

          40KB

        • memory/5016-63-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-57-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-23-0x00000000078D0000-0x000000000790A000-memory.dmp

          Filesize

          232KB

        • memory/5016-24-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-47-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-87-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-86-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-83-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-81-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-79-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-77-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-75-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-73-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-71-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-69-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-67-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-65-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-21-0x0000000004CE0000-0x0000000004D1C000-memory.dmp

          Filesize

          240KB

        • memory/5016-816-0x0000000009DD0000-0x000000000A3E8000-memory.dmp

          Filesize

          6.1MB

        • memory/5016-61-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-59-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-22-0x0000000007320000-0x00000000078C4000-memory.dmp

          Filesize

          5.6MB

        • memory/5016-55-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-53-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-51-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-49-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-45-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-43-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-41-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-817-0x000000000A490000-0x000000000A4A2000-memory.dmp

          Filesize

          72KB

        • memory/5016-39-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-37-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-35-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-33-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-31-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-29-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-25-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-27-0x00000000078D0000-0x0000000007905000-memory.dmp

          Filesize

          212KB

        • memory/5016-818-0x000000000A4B0000-0x000000000A5BA000-memory.dmp

          Filesize

          1.0MB

        • memory/5016-819-0x000000000A5E0000-0x000000000A61C000-memory.dmp

          Filesize

          240KB

        • memory/5016-820-0x0000000004C50000-0x0000000004C9C000-memory.dmp

          Filesize

          304KB