Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:35

General

  • Target

    4ad35be0162b9c88e44b8ddd41f91ad642ca51caca5eba0af45b6d211a7e6a5d.exe

  • Size

    707KB

  • MD5

    89bbc273201dc3d90c997916c5e67503

  • SHA1

    d3092af12940baef089c3854f3d323438002d9de

  • SHA256

    4ad35be0162b9c88e44b8ddd41f91ad642ca51caca5eba0af45b6d211a7e6a5d

  • SHA512

    d1866cf9a8d6833bf2703579eca2d0d30e332f717eaa04dc13887b989439e8601f792b39784c419d3fa169a57118c229626d9e3dcace693f76d6876c6d07dcf8

  • SSDEEP

    12288:Gy90318S49tnCc3gQ/FL4L6YP1EkHFXs2SPamuOVztNJTRpl0n+P1GRL/p9:GyD59L4fdEgFX/SvuOV/tPl0nXRL/L

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ad35be0162b9c88e44b8ddd41f91ad642ca51caca5eba0af45b6d211a7e6a5d.exe
    "C:\Users\Admin\AppData\Local\Temp\4ad35be0162b9c88e44b8ddd41f91ad642ca51caca5eba0af45b6d211a7e6a5d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590812.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590812.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr093387.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr093387.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4828
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1092
          4⤵
          • Program crash
          PID:3496
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu828940.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu828940.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1136
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4828 -ip 4828
    1⤵
      PID:1436

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590812.exe

      Filesize

      553KB

      MD5

      355793460c8e3754955d5a22f688f72a

      SHA1

      171deacc4a490abadd70df3d3557a0233c8537f1

      SHA256

      5b151bce68b95ab35a8ac0e68e8275e9568eb7ff78f63c81b4ed39acb62e7762

      SHA512

      e0726a698545d1cfaa35420ccb121e5302768ad8e55f7666f60c8edbd23b8fb976a8c6ea927eb92ad28bb9099968a3e22b4326e61add1a96dc670f521f476adf

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr093387.exe

      Filesize

      299KB

      MD5

      3b5df25052b11fa0fd05ee79829cfbd3

      SHA1

      6b001c39513cc5775253e58057ad596a76290e9d

      SHA256

      09931155bec8fbbd56a8ac0faa50455ecdecee80bf95ed053b6cf1b91b1e3cc6

      SHA512

      a0fe0c1a1a83e2576b12906539de871d0ce726ae5f04c4e98b8d8d671875ce9adb3f83b484dbdd56ab0996ce04718b04c512dae94a4fc88f0d738afcede3ab75

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu828940.exe

      Filesize

      381KB

      MD5

      fb6e52bfa142536de1e94d6348cf3db7

      SHA1

      66dd8caa27bff85706527e4d999753531865abf9

      SHA256

      dcb0957ce6316871a94984a6511103fb6189cdbc92d52ecc766faa0bcabaae3a

      SHA512

      55c54d04a76c56ba60b6e94d93e6e0c127257f9400f0f44f996bb46c59a2ed4141287378531ebd17c581b8ee2eac298b1ec6b1a8761d097790718f377096f8a2

    • memory/1136-74-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-78-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-854-0x000000000A340000-0x000000000A352000-memory.dmp

      Filesize

      72KB

    • memory/1136-853-0x0000000009C80000-0x000000000A298000-memory.dmp

      Filesize

      6.1MB

    • memory/1136-61-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-62-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-64-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-88-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-68-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-70-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-856-0x000000000A490000-0x000000000A4CC000-memory.dmp

      Filesize

      240KB

    • memory/1136-857-0x00000000048A0000-0x00000000048EC000-memory.dmp

      Filesize

      304KB

    • memory/1136-76-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-855-0x000000000A360000-0x000000000A46A000-memory.dmp

      Filesize

      1.0MB

    • memory/1136-80-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-82-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-84-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-86-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-91-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-92-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-94-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-72-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-66-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/1136-60-0x0000000004B80000-0x0000000004BBA000-memory.dmp

      Filesize

      232KB

    • memory/1136-59-0x0000000004AE0000-0x0000000004B1C000-memory.dmp

      Filesize

      240KB

    • memory/4828-40-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-54-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4828-53-0x0000000000400000-0x0000000002BB4000-memory.dmp

      Filesize

      39.7MB

    • memory/4828-50-0x0000000000400000-0x0000000002BB4000-memory.dmp

      Filesize

      39.7MB

    • memory/4828-51-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4828-49-0x0000000002E00000-0x0000000002F00000-memory.dmp

      Filesize

      1024KB

    • memory/4828-21-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-22-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-24-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-26-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-28-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-30-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-35-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-36-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-38-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-42-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-44-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-46-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-48-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-32-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4828-20-0x0000000007140000-0x0000000007158000-memory.dmp

      Filesize

      96KB

    • memory/4828-19-0x0000000007210000-0x00000000077B4000-memory.dmp

      Filesize

      5.6MB

    • memory/4828-18-0x0000000000400000-0x0000000002BB4000-memory.dmp

      Filesize

      39.7MB

    • memory/4828-17-0x0000000004BD0000-0x0000000004BEA000-memory.dmp

      Filesize

      104KB

    • memory/4828-15-0x0000000002E00000-0x0000000002F00000-memory.dmp

      Filesize

      1024KB

    • memory/4828-16-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB