Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:40

General

  • Target

    6f6b8e10bd390fe66f9a022a5d2faa0a2b1ad0c6bdd222fde89994061e4b9429.exe

  • Size

    559KB

  • MD5

    e4816ba71f5ff81a110dff574f2bf483

  • SHA1

    6d468ce85df250c7f511a28176ca3d891ca4d952

  • SHA256

    6f6b8e10bd390fe66f9a022a5d2faa0a2b1ad0c6bdd222fde89994061e4b9429

  • SHA512

    9e8ddfefc7a4e834d137291040464ce78c86ad156f538416b570a298c2f0804a7d7a1d46bf17f0cd4718e682c91aab499726531686165736f8af530f72762911

  • SSDEEP

    12288:oy90p4mMDL1U0moqv33CwAZmz2EFtrBrYh1nfn:oy+4meqoc36ZVG5BWhn

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f6b8e10bd390fe66f9a022a5d2faa0a2b1ad0c6bdd222fde89994061e4b9429.exe
    "C:\Users\Admin\AppData\Local\Temp\6f6b8e10bd390fe66f9a022a5d2faa0a2b1ad0c6bdd222fde89994061e4b9429.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3824
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqq4304.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqq4304.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:428
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it759862.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it759862.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4048
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp747891.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp747891.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziqq4304.exe

    Filesize

    405KB

    MD5

    727f3f8f16dabd7ae7de9190c878cb02

    SHA1

    fae729f80ef86b4affa782922f08b2cee54a78ab

    SHA256

    4aad6341614a6cc15c5e34ed9cd4a0d9d73db084ab21aa1e6eeab5faf1c5ba05

    SHA512

    e486ae1880037c6ccb42affe25b8be21318dd33917ae39c1469e02ca6154072ebc9b19306a4432246efb48ca65602f8a16ad73c81c850d6ac4a86bf899f1ebaa

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it759862.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp747891.exe

    Filesize

    352KB

    MD5

    9a11b9c6e3be7fcfedd4d2fd4c9958a6

    SHA1

    54bddc586751d40ca482eb4505fa38aeaf3f3461

    SHA256

    5675a681610e6bd70f91d7874b14f74ea25cc610fb4ccf3ba2863bc09c3094bf

    SHA512

    f4519e5f8713f938e7002cda6afa0b46da1d47e3075d04e663b371d75f1b6872830b08bcfdb88bc607f498fb17fa5b19fc38635d326288f8c1576dfaa102c887

  • memory/1704-59-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-22-0x00000000074F0000-0x0000000007A94000-memory.dmp

    Filesize

    5.6MB

  • memory/1704-21-0x0000000004D10000-0x0000000004D4C000-memory.dmp

    Filesize

    240KB

  • memory/1704-55-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-23-0x00000000072F0000-0x000000000732A000-memory.dmp

    Filesize

    232KB

  • memory/1704-45-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-51-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-87-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-85-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-83-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-81-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-79-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-77-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-73-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-71-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-53-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-67-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-65-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-61-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-820-0x0000000004C10000-0x0000000004C5C000-memory.dmp

    Filesize

    304KB

  • memory/1704-819-0x000000000A5D0000-0x000000000A60C000-memory.dmp

    Filesize

    240KB

  • memory/1704-57-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-69-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-49-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-47-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-43-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-41-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-39-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-38-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-35-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-33-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-75-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-63-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-31-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-29-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-27-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-25-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-24-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/1704-816-0x0000000009E20000-0x000000000A438000-memory.dmp

    Filesize

    6.1MB

  • memory/1704-817-0x000000000A490000-0x000000000A4A2000-memory.dmp

    Filesize

    72KB

  • memory/1704-818-0x000000000A4B0000-0x000000000A5BA000-memory.dmp

    Filesize

    1.0MB

  • memory/4048-15-0x0000000000750000-0x000000000075A000-memory.dmp

    Filesize

    40KB

  • memory/4048-14-0x00007FFB07063000-0x00007FFB07065000-memory.dmp

    Filesize

    8KB