Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:41

General

  • Target

    4e585e4e1a4e3966855e083ae2dc9a046685ccb834ae34360e77b42c5b72b067.exe

  • Size

    479KB

  • MD5

    23e63039c04589ffaf13d23591708a73

  • SHA1

    9bf4ca291b58837a1b33806a6e6802fa57a42d7b

  • SHA256

    4e585e4e1a4e3966855e083ae2dc9a046685ccb834ae34360e77b42c5b72b067

  • SHA512

    2bb471992a4d7716035ee350d990641f1ddf2c7145e542f32a950b4b7d8e47ecee283036d7ff91fbe5fb8711a00f71e5afffbcf6bea5b666b13950b073c9e280

  • SSDEEP

    12288:yMrby90Nx5EO8PQxI1m7Od6PjeikRzQcM/Q:ZycrEFoxI0O8a3QcJ

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e585e4e1a4e3966855e083ae2dc9a046685ccb834ae34360e77b42c5b72b067.exe
    "C:\Users\Admin\AppData\Local\Temp\4e585e4e1a4e3966855e083ae2dc9a046685ccb834ae34360e77b42c5b72b067.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3166271.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3166271.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3006099.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3006099.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3980
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2756482.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2756482.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3166271.exe

    Filesize

    307KB

    MD5

    3b75e5d3426e90a367e4b6a96485118a

    SHA1

    fc7314c2ed750e9a2154318fee4e127ade6a9c47

    SHA256

    5750d4d8310b1aabd49541d86ffcab9a6ad7beab24a9140296c5017e21eaf8f0

    SHA512

    ff365753356de5b75e2c00bc22051c9d982377f3d4f46f907622c3ff975aa6841ffa2daba672120505417bf95ae5bc4677affd361386ae5b77ae8aeaf8cf12e5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3006099.exe

    Filesize

    175KB

    MD5

    563e182784ada69cd20fa368a66fb9be

    SHA1

    f8e348ec4348e5e31a3af6b5b25f7168950660e1

    SHA256

    89632614e919a9d7e4759f1131bf34c3ed060b5855812adce069d4d0abad1279

    SHA512

    a5e5846081a860a42154ae533bbe738a321f61de9bb504a7aafabe4153dbbcbd8ed224b272b574047296f8ec6272706947794fe2b332770d02a49fd73e8f44dc

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2756482.exe

    Filesize

    136KB

    MD5

    c73e1aef0c2cc7fcc6d8e26f6218147f

    SHA1

    730771aedd329cb4c97a827268395481e9df0353

    SHA256

    bd36f052ea89dd29366888c0c34bd75eec72d2d42b4a211757a9ba40422f30bb

    SHA512

    189c8dc6fdb76160a54bb8c9eb6d48d28290b2451e21c9bbb9e4cc58f3fd1e5bfc3aa1a09af6f75afcde1e275f21b5cdb0d05102bfe4fbb33ba09e73b1f3e7ff

  • memory/3672-61-0x0000000007820000-0x000000000786C000-memory.dmp

    Filesize

    304KB

  • memory/3672-60-0x0000000007880000-0x00000000078BC000-memory.dmp

    Filesize

    240KB

  • memory/3672-59-0x0000000007910000-0x0000000007A1A000-memory.dmp

    Filesize

    1.0MB

  • memory/3672-58-0x00000000077E0000-0x00000000077F2000-memory.dmp

    Filesize

    72KB

  • memory/3672-57-0x0000000007D50000-0x0000000008368000-memory.dmp

    Filesize

    6.1MB

  • memory/3672-56-0x0000000000A80000-0x0000000000AA8000-memory.dmp

    Filesize

    160KB

  • memory/3980-33-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-20-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-39-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-23-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-45-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-37-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-35-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-43-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-31-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-29-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-27-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-25-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-21-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-41-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-48-0x0000000073B90000-0x0000000074340000-memory.dmp

    Filesize

    7.7MB

  • memory/3980-49-0x0000000073B9E000-0x0000000073B9F000-memory.dmp

    Filesize

    4KB

  • memory/3980-50-0x0000000073B90000-0x0000000074340000-memory.dmp

    Filesize

    7.7MB

  • memory/3980-52-0x0000000073B90000-0x0000000074340000-memory.dmp

    Filesize

    7.7MB

  • memory/3980-47-0x0000000004980000-0x0000000004992000-memory.dmp

    Filesize

    72KB

  • memory/3980-19-0x0000000073B90000-0x0000000074340000-memory.dmp

    Filesize

    7.7MB

  • memory/3980-18-0x0000000004980000-0x0000000004998000-memory.dmp

    Filesize

    96KB

  • memory/3980-17-0x0000000004B20000-0x00000000050C4000-memory.dmp

    Filesize

    5.6MB

  • memory/3980-16-0x0000000073B90000-0x0000000074340000-memory.dmp

    Filesize

    7.7MB

  • memory/3980-15-0x0000000002230000-0x000000000224A000-memory.dmp

    Filesize

    104KB

  • memory/3980-14-0x0000000073B9E000-0x0000000073B9F000-memory.dmp

    Filesize

    4KB