Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:17

General

  • Target

    171e135d9e6cf21e8324f48b476c3b2d0d1e2c598d36d622381e088674cf5f61.exe

  • Size

    690KB

  • MD5

    839f23455822663d3b70ee552ade783a

  • SHA1

    33fb270e1d19d6340c0580eb8c7bf72e9424c3a5

  • SHA256

    171e135d9e6cf21e8324f48b476c3b2d0d1e2c598d36d622381e088674cf5f61

  • SHA512

    122360170217c3d0ac68df455bc86307c6f15f3e8dae53518d8584c7a231e623fce46b0d4914aac9170c4fcf81b8f0855c1c256671cd47457e853eba4c0dc85b

  • SSDEEP

    12288:gy90XI15ZEaoFCFmcM0hDXL7BoOSFKt8OmkAWlp/rjk0feV2/mkWGvVkwl:gyF15Xme1XLNQi8Omk1jj1Q2/Zjxl

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\171e135d9e6cf21e8324f48b476c3b2d0d1e2c598d36d622381e088674cf5f61.exe
    "C:\Users\Admin\AppData\Local\Temp\171e135d9e6cf21e8324f48b476c3b2d0d1e2c598d36d622381e088674cf5f61.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933378.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933378.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\61762759.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\61762759.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2336
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1080
          4⤵
          • Program crash
          PID:4240
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk061445.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk061445.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2336 -ip 2336
    1⤵
      PID:552

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un933378.exe

            Filesize

            536KB

            MD5

            c8013c1272b6af8e39fea625f282447b

            SHA1

            c1e483c4ec502feacc360a7311b5c19c790eafbb

            SHA256

            53c6c09328301927eb83ddbb36ab7a202fc816d4026de248dde6dfb62684e4e1

            SHA512

            793fb8730924c6300daf76acebbefc90bc13632c923c85244fdf32d9117009d2006db0e225d25958e3be21e2378d7a30eb1259859c31b28e15bcf7aa7df504c4

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\61762759.exe

            Filesize

            259KB

            MD5

            2d931ae2edddefc5a6196c5a7676e96a

            SHA1

            bc11272b2d64341b430e695f56579cfd6cca11b3

            SHA256

            e472fc30098cc8b8c9ec12dfa7628147dbea384ce45cd6b260c8a287113cb8e7

            SHA512

            e9ccd5480125dc5c916683869984401d7ae65007a6e1763dfdcd8e6da02fbc9b8064eb85cc87abbba28344d22d3680ab865de41dd10301ba3903827eb220d626

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk061445.exe

            Filesize

            341KB

            MD5

            5fbb034af5234de5c6c531ab4733c994

            SHA1

            79aee06a8e04fc0bfcee06d8b7bc0d4b390eb480

            SHA256

            7e761cf897fc10405bf32de865f74d4d03702c00200152bb175eaa385a6055c4

            SHA512

            ddb9b37efa8805691148410ecde21353f0c06421644c5f12c6429fb792d91aa740fac1145f6231252e0a0584ed87011af14fba1bfc64fd8c4230e2af8a8f1713

          • memory/2336-15-0x0000000000640000-0x0000000000740000-memory.dmp

            Filesize

            1024KB

          • memory/2336-17-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/2336-16-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2336-18-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/2336-19-0x0000000002260000-0x000000000227A000-memory.dmp

            Filesize

            104KB

          • memory/2336-20-0x0000000004A40000-0x0000000004FE4000-memory.dmp

            Filesize

            5.6MB

          • memory/2336-21-0x00000000022D0000-0x00000000022E8000-memory.dmp

            Filesize

            96KB

          • memory/2336-47-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-27-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-49-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-45-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-43-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-41-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-40-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-37-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-35-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-33-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-31-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-29-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-25-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-23-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-22-0x00000000022D0000-0x00000000022E3000-memory.dmp

            Filesize

            76KB

          • memory/2336-50-0x0000000000640000-0x0000000000740000-memory.dmp

            Filesize

            1024KB

          • memory/2336-51-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2336-54-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

          • memory/2336-55-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/5024-60-0x0000000002500000-0x000000000253C000-memory.dmp

            Filesize

            240KB

          • memory/5024-61-0x0000000004A80000-0x0000000004ABA000-memory.dmp

            Filesize

            232KB

          • memory/5024-72-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-90-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-93-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-91-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-87-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-85-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-83-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-81-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-79-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-77-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-75-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-73-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-95-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-69-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-67-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-65-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-63-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-62-0x0000000004A80000-0x0000000004AB5000-memory.dmp

            Filesize

            212KB

          • memory/5024-854-0x00000000075E0000-0x0000000007BF8000-memory.dmp

            Filesize

            6.1MB

          • memory/5024-855-0x0000000007C00000-0x0000000007C12000-memory.dmp

            Filesize

            72KB

          • memory/5024-856-0x0000000007C20000-0x0000000007D2A000-memory.dmp

            Filesize

            1.0MB

          • memory/5024-857-0x0000000007D30000-0x0000000007D6C000-memory.dmp

            Filesize

            240KB

          • memory/5024-858-0x00000000045B0000-0x00000000045FC000-memory.dmp

            Filesize

            304KB