Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:30

General

  • Target

    d83b84b8e2de4dc4f754ee5f208c10361082a044bd3835aff368794280cc649a.exe

  • Size

    807KB

  • MD5

    0efe72f8fb6b726305a4e098eac6ad34

  • SHA1

    92f77734a401813fc9ff0a986294e5f99ed73184

  • SHA256

    d83b84b8e2de4dc4f754ee5f208c10361082a044bd3835aff368794280cc649a

  • SHA512

    c825cac44cc3d4baf85869da0f67f9dbe7aedb8df6c95f0e9627e9f961f4bfd536166195e4a94b14b451dbe1cd3fb5c439c3aa1caed4fdcbf0af62aa01938096

  • SSDEEP

    12288:Wy90Zns1Q8dv6RQvRbpH1/2DLuHixPBwp8Bv5Sucl4cTAlzen4Wcih:WyR1QKAPDli6BHcZTEK4mh

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d83b84b8e2de4dc4f754ee5f208c10361082a044bd3835aff368794280cc649a.exe
    "C:\Users\Admin\AppData\Local\Temp\d83b84b8e2de4dc4f754ee5f208c10361082a044bd3835aff368794280cc649a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuQ9429.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuQ9429.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zibJ9869.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zibJ9869.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3740
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it444758.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it444758.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:432
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr436249.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr436249.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuQ9429.exe

    Filesize

    558KB

    MD5

    76138f33ee3cb410f174f687172e5c59

    SHA1

    c89e49f5a19f9bb2cb587bb00d7d8b9c01b18c84

    SHA256

    f9683e9f2931560e9935e54988a30c709ecf0d92809b9f8df6120335bed587f3

    SHA512

    824eb9e72ebd30f8abe5e359b745f1bc654120867b1610f73952b25aaa780dd83ea424e282d52d71ebf7b16719688afcebba468e00792fd470d7a3ec126cb2ef

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zibJ9869.exe

    Filesize

    404KB

    MD5

    3aa531cd17f2e1b2f4556b2c38230557

    SHA1

    f282f98f7abc8431e701246a158798502e9e6d49

    SHA256

    a70d5d989b22fe57348514dcf12733b0d9ffc2476759a5558cd9d2d2bc92d99e

    SHA512

    3ed0e04e3234beb3241ce2b19ead86a58e2130ef0a8e4c38febe6c5fe44cafd75332ec03dd980135f5877ecb3389201a6832bec295ee003269f18584ff56330c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it444758.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr436249.exe

    Filesize

    361KB

    MD5

    89af51aff5823c35a8860631606347c6

    SHA1

    e29eaa739478eb59c74706849237b5491f4c27ab

    SHA256

    6220f47829e4c6bb99b24660d06239ea86c77c16d7a471b20ea76ac6bcc5d212

    SHA512

    4f68df862cff9c60e92bf71711bcbc401c2ff1f73dc37dcf70e6848e0957b21b7b59dd5b768b16ca17291170afee66e6b1f1674ca3c167a1cc9e05f634f65647

  • memory/432-21-0x00007FFB289D3000-0x00007FFB289D5000-memory.dmp

    Filesize

    8KB

  • memory/432-22-0x0000000000420000-0x000000000042A000-memory.dmp

    Filesize

    40KB

  • memory/432-23-0x00007FFB289D3000-0x00007FFB289D5000-memory.dmp

    Filesize

    8KB

  • memory/2436-78-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-67-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-31-0x00000000072D0000-0x000000000730A000-memory.dmp

    Filesize

    232KB

  • memory/2436-41-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-37-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-35-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-33-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-32-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-51-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-96-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-93-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-91-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-87-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-85-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-83-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-81-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-79-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-29-0x0000000007240000-0x000000000727C000-memory.dmp

    Filesize

    240KB

  • memory/2436-73-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-71-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-69-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-30-0x0000000007430000-0x00000000079D4000-memory.dmp

    Filesize

    5.6MB

  • memory/2436-63-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-61-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-59-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-57-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-53-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-49-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-47-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-45-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-43-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-39-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-89-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-75-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-65-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-55-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/2436-825-0x000000000A480000-0x000000000A492000-memory.dmp

    Filesize

    72KB

  • memory/2436-826-0x000000000A4A0000-0x000000000A5AA000-memory.dmp

    Filesize

    1.0MB

  • memory/2436-827-0x000000000A5D0000-0x000000000A60C000-memory.dmp

    Filesize

    240KB

  • memory/2436-824-0x0000000009E60000-0x000000000A478000-memory.dmp

    Filesize

    6.1MB

  • memory/2436-828-0x0000000004C20000-0x0000000004C6C000-memory.dmp

    Filesize

    304KB