Analysis

  • max time kernel
    141s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:18

General

  • Target

    4eeffbc8271a1be62554c092394087e212943fef623cc174cd30259d5d92f3d1.exe

  • Size

    643KB

  • MD5

    426d2d722f717d4cb8eec7496034812c

  • SHA1

    453c7601a9ed9896d0387f0fa805d70a1906d63a

  • SHA256

    4eeffbc8271a1be62554c092394087e212943fef623cc174cd30259d5d92f3d1

  • SHA512

    7e3cce7aa108261b7681a7c91458775d8a3bab1250742f0fa6e11f18b62fe505c41513ec0af91835b8d372c749f5c27c5efb19243e9e6d7ef4d16389ca8b6012

  • SSDEEP

    12288:Hy900ZthmABaZpwY5UBtK10cDPV1BY3niIVdUN/fSj8PBpB812KcAxPb:HyrhCTwY5UK10cDt1BY3TdUBa8Y2K5xT

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4eeffbc8271a1be62554c092394087e212943fef623cc174cd30259d5d92f3d1.exe
    "C:\Users\Admin\AppData\Local\Temp\4eeffbc8271a1be62554c092394087e212943fef623cc174cd30259d5d92f3d1.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st722202.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st722202.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\37524680.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\37524680.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2740
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp669612.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp669612.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st722202.exe

          Filesize

          489KB

          MD5

          0c83fe00719fe9b4ac925f876696b5e0

          SHA1

          a4ea04a08b0e3f2a76b923fcc1d4033b358947df

          SHA256

          a279adfbf1b501606ca9635c3000ad293cc88f13fa06cb74e432fe8a13ac7c65

          SHA512

          a102a0c5ff4da5dfcd7ab41234015525d6c84b691b9b91db9295eb3c1386778e6ed2c831b1e4fc58cb264b3bffc9d188668bd5638f7fa79442d87a8d02b8674b

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\37524680.exe

          Filesize

          176KB

          MD5

          2b71f4b18ac8214a2bff547b6ce2f64f

          SHA1

          b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

          SHA256

          f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

          SHA512

          33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp669612.exe

          Filesize

          341KB

          MD5

          776e830f8a92292e4a05160478256a1c

          SHA1

          4c1cf53e82b50ec5e0940392673dfae04d9c0d56

          SHA256

          7ac9ad65155a86d62ae3741e7e767e0378e8833da25b6220d13872aff8edf6f4

          SHA512

          a3c690902b2e8bf040602dd0f0bc6458ed361e2d7c7f964409a0ff6d6c7cf81c05157bb9d4725fb926c6e493c60b2d5dd1fc3802e9227d8d5bb3f64063cb5dba

        • memory/2740-50-0x0000000074290000-0x0000000074A40000-memory.dmp

          Filesize

          7.7MB

        • memory/2740-14-0x000000007429E000-0x000000007429F000-memory.dmp

          Filesize

          4KB

        • memory/2740-18-0x0000000005080000-0x0000000005098000-memory.dmp

          Filesize

          96KB

        • memory/2740-16-0x0000000074290000-0x0000000074A40000-memory.dmp

          Filesize

          7.7MB

        • memory/2740-19-0x0000000074290000-0x0000000074A40000-memory.dmp

          Filesize

          7.7MB

        • memory/2740-20-0x0000000074290000-0x0000000074A40000-memory.dmp

          Filesize

          7.7MB

        • memory/2740-22-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-42-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-48-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-46-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-44-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-40-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-38-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-36-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-34-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-32-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-30-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-28-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-26-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-21-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-24-0x0000000005080000-0x0000000005093000-memory.dmp

          Filesize

          76KB

        • memory/2740-49-0x000000007429E000-0x000000007429F000-memory.dmp

          Filesize

          4KB

        • memory/2740-15-0x0000000002500000-0x000000000251A000-memory.dmp

          Filesize

          104KB

        • memory/2740-52-0x0000000074290000-0x0000000074A40000-memory.dmp

          Filesize

          7.7MB

        • memory/2740-17-0x0000000004A90000-0x0000000005034000-memory.dmp

          Filesize

          5.6MB

        • memory/4548-60-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-80-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-78-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-86-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-94-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-92-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-90-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-88-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-84-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-82-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-58-0x00000000071B0000-0x00000000071EA000-memory.dmp

          Filesize

          232KB

        • memory/4548-76-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-75-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-73-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-70-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-68-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-66-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-62-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-64-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-57-0x0000000007130000-0x000000000716C000-memory.dmp

          Filesize

          240KB

        • memory/4548-59-0x00000000071B0000-0x00000000071E5000-memory.dmp

          Filesize

          212KB

        • memory/4548-851-0x0000000009CF0000-0x000000000A308000-memory.dmp

          Filesize

          6.1MB

        • memory/4548-852-0x000000000A330000-0x000000000A342000-memory.dmp

          Filesize

          72KB

        • memory/4548-853-0x000000000A350000-0x000000000A45A000-memory.dmp

          Filesize

          1.0MB

        • memory/4548-854-0x000000000A470000-0x000000000A4AC000-memory.dmp

          Filesize

          240KB

        • memory/4548-855-0x000000000A5F0000-0x000000000A63C000-memory.dmp

          Filesize

          304KB