Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:36

General

  • Target

    955cf549414927f3c0e750697515eafd1373a71e3bac7b3d7a90e6bd834c3b63.exe

  • Size

    690KB

  • MD5

    60b21539ecd57098faec643a8ad1325b

  • SHA1

    8b670d2d46fc78e8f8f29be6970ec8cc73a4e75d

  • SHA256

    955cf549414927f3c0e750697515eafd1373a71e3bac7b3d7a90e6bd834c3b63

  • SHA512

    8939c9499c226b9326f6bb720d204c0b4567ed477db41381c51ccdf00e98e2c45e66183322ceed0c7ac022697a11f969ef4e9c2ae0df75fa5c338c4058132ef1

  • SSDEEP

    12288:by90VNDBZb7UNEK3RnNS/K4Im4AdyteLVxhR0sKfb2ym+kuX:byKDPUNB3Iim43texxTKz2yvrX

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\955cf549414927f3c0e750697515eafd1373a71e3bac7b3d7a90e6bd834c3b63.exe
    "C:\Users\Admin\AppData\Local\Temp\955cf549414927f3c0e750697515eafd1373a71e3bac7b3d7a90e6bd834c3b63.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un287348.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un287348.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\47764990.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\47764990.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 1088
          4⤵
          • Program crash
          PID:996
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk306350.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk306350.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2800 -ip 2800
    1⤵
      PID:5112

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un287348.exe

      Filesize

      536KB

      MD5

      d7f5d5396951417d14ca787e07fab222

      SHA1

      02f61860a7f77e874fd2c2e63f3f1fcb710d9013

      SHA256

      272b59e93882835b6a6787b2ac77eebbc85c4483d90b2911954b6b3df64a1b34

      SHA512

      d07e9980d1fd4541d15dcdb9b9735f1aff2b4d1b5baf8521feabc6259c80cc21b60fa636af23003210d88be7d33bd5f2630949825ae5357dddd416fa84e79e1e

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\47764990.exe

      Filesize

      259KB

      MD5

      f7c6d08f6fcdadcb2c1220d9d76c49cf

      SHA1

      ed0eb68b0ad31a0550b20ec43dc002e56fa154e6

      SHA256

      52f2c5b12848266cda3351c1e1a02f84a6938d645f347c223fd6fe194d6096c6

      SHA512

      696a1fb263af06407bf8a06c96af5ae624aef8af8ef225aa83c2b7d38f2065b8195e4579a7594896f460d64b2cdb08f961fe7c75bd7e0f1f38335cb35d71d25b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk306350.exe

      Filesize

      341KB

      MD5

      7b3f5d71d3243761565d9c9fa752d0b7

      SHA1

      c8394f59c307cc22a4599e7c89514eb31a08fccf

      SHA256

      68ed4d61c3026da0fe38f08510de6426db891a37446fdf8a278fa21c33e079f0

      SHA512

      d01ed08d85f7623d3549432df1422ea62d84501779bf6af2ad6ca9679d1af30a4cadd2c73d9775e14ee3968467528531f9d27e74ca00956c7d0d1b7aee44834f

    • memory/1020-76-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-80-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-856-0x0000000004B90000-0x0000000004BA2000-memory.dmp

      Filesize

      72KB

    • memory/1020-855-0x0000000007620000-0x0000000007C38000-memory.dmp

      Filesize

      6.1MB

    • memory/1020-63-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-64-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-68-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-70-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-72-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-74-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-858-0x0000000007D50000-0x0000000007D8C000-memory.dmp

      Filesize

      240KB

    • memory/1020-859-0x0000000004550000-0x000000000459C000-memory.dmp

      Filesize

      304KB

    • memory/1020-78-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-857-0x0000000007C40000-0x0000000007D4A000-memory.dmp

      Filesize

      1.0MB

    • memory/1020-82-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-84-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-88-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-90-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-93-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-94-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-97-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-86-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-66-0x0000000004A60000-0x0000000004A95000-memory.dmp

      Filesize

      212KB

    • memory/1020-62-0x0000000004A60000-0x0000000004A9A000-memory.dmp

      Filesize

      232KB

    • memory/1020-61-0x00000000024E0000-0x000000000251C000-memory.dmp

      Filesize

      240KB

    • memory/2800-43-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2800-55-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2800-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2800-51-0x0000000000580000-0x00000000005AD000-memory.dmp

      Filesize

      180KB

    • memory/2800-50-0x0000000000600000-0x0000000000700000-memory.dmp

      Filesize

      1024KB

    • memory/2800-23-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-25-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-27-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-29-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-31-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-33-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-35-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-37-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-39-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-41-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-45-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-47-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-49-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-22-0x00000000049F0000-0x0000000004A03000-memory.dmp

      Filesize

      76KB

    • memory/2800-21-0x00000000049F0000-0x0000000004A08000-memory.dmp

      Filesize

      96KB

    • memory/2800-20-0x0000000004B90000-0x0000000005134000-memory.dmp

      Filesize

      5.6MB

    • memory/2800-19-0x0000000002380000-0x000000000239A000-memory.dmp

      Filesize

      104KB

    • memory/2800-18-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2800-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2800-16-0x0000000000580000-0x00000000005AD000-memory.dmp

      Filesize

      180KB

    • memory/2800-15-0x0000000000600000-0x0000000000700000-memory.dmp

      Filesize

      1024KB