Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 00:38

General

  • Target

    eb39ba213c4cb0675de064d9d9f227acea0b72c577b3080da10d10b1a392eb79.exe

  • Size

    1.1MB

  • MD5

    59a886310f4f04a8a16823a44ae312b8

  • SHA1

    a1cd16e2a73bfb012f362b54646290baa0b45433

  • SHA256

    eb39ba213c4cb0675de064d9d9f227acea0b72c577b3080da10d10b1a392eb79

  • SHA512

    abb8417ab077669cccbdab6b80501364badda045e2131f391789c3a5b95ee324ea087a2c58f5edebc4d6911e85259a8cc99f29cf43462d4556ba10aaa4148738

  • SSDEEP

    24576:vyxs2JzUOdpymHriVBG3cZeWC/03bCEoodlIRivbnNDlBQ:6xs2lDdpLHriDZdC+bCEFl8ivbnNDlB

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb39ba213c4cb0675de064d9d9f227acea0b72c577b3080da10d10b1a392eb79.exe
    "C:\Users\Admin\AppData\Local\Temp\eb39ba213c4cb0675de064d9d9f227acea0b72c577b3080da10d10b1a392eb79.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un323573.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un323573.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un949523.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un949523.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr281587.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr281587.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4412
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 1100
            5⤵
            • Program crash
            PID:2860
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu232291.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu232291.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4772
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4412 -ip 4412
    1⤵
      PID:4824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un323573.exe

      Filesize

      764KB

      MD5

      74a1ee5b23695210a277ff12794ef5d8

      SHA1

      9cd5fde9384fe21ed8425d886c63137757583883

      SHA256

      e859578d7e0d27714bb697f0ba31428be00219d26acfcd3690dc1890b6130932

      SHA512

      8e7f3abdc78f7b68ecdf1deb52033bbd5de1859fd2ffb1143e2cff079e283e11c379877f3b913788ba411f0902d1b8ddc368ae540b82c06e54a96da407b6cdd6

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un949523.exe

      Filesize

      609KB

      MD5

      826ad380413a11d16cfe5adc3b7e1d1b

      SHA1

      32f59be87636398824261052292553dc66df877c

      SHA256

      9ff86e2fa203afb64379ae873252de2a21ec376c6fb959aea66e14b2633f4849

      SHA512

      2e9bc80500a04120d0f7b2ca9c673909b76ccb53085b7a93224838de48e0e5994664314db2df9ea9f880f06b80f046295828338dd5419080661b2017db8cb3c0

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr281587.exe

      Filesize

      406KB

      MD5

      94118e0267766a75ceae3e1d221d60e6

      SHA1

      7861f1cfd1b38adac15b86c6a39bb241ce6456e4

      SHA256

      9608a9cac0cd5218bb4a6e4371b2bc1c1aff1a5b19afcc6ed19a000eea8fff56

      SHA512

      5769e4ffd7240fe2f75034b736d6ec6aee935ce0ab9db3cc54fd2c3735448e69cdc75cc7ed1632a4b136a2db4d2e3eee5e0c9ffa3a1af49388257a44a33b39d9

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu232291.exe

      Filesize

      487KB

      MD5

      1d03672d249a2318f3b8a462ce3e1eec

      SHA1

      e3fc945cfb73d34775271d8b4feb020fb3059ac8

      SHA256

      38de64906aa39be758984067753915bb4fe7d7a449c0e0bcd3f6209652d9e17a

      SHA512

      17d3f152f2238baf2c271c665fe8977dea8f761073840911ed0846bf6cc17bef74d2da78a7c415a05d19f1304bfa311d17356f3628442edb792c7c9ae7e017b0

    • memory/4412-54-0x0000000000400000-0x000000000080A000-memory.dmp

      Filesize

      4.0MB

    • memory/4412-24-0x0000000004ED0000-0x0000000005474000-memory.dmp

      Filesize

      5.6MB

    • memory/4412-25-0x00000000054C0000-0x00000000054D8000-memory.dmp

      Filesize

      96KB

    • memory/4412-31-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-53-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-51-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-49-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-47-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-45-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-43-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-41-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-39-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-37-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-35-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-33-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-27-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-26-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-30-0x00000000054C0000-0x00000000054D2000-memory.dmp

      Filesize

      72KB

    • memory/4412-55-0x0000000000970000-0x0000000000A70000-memory.dmp

      Filesize

      1024KB

    • memory/4412-23-0x0000000002530000-0x000000000254A000-memory.dmp

      Filesize

      104KB

    • memory/4412-57-0x0000000000400000-0x000000000080A000-memory.dmp

      Filesize

      4.0MB

    • memory/4412-22-0x0000000000970000-0x0000000000A70000-memory.dmp

      Filesize

      1024KB

    • memory/4772-65-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-77-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-95-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-79-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-97-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-64-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-93-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-91-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-89-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-87-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-85-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-83-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-81-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-859-0x00000000080F0000-0x000000000812C000-memory.dmp

      Filesize

      240KB

    • memory/4772-75-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-73-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-71-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-69-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-67-0x00000000028E0000-0x0000000002915000-memory.dmp

      Filesize

      212KB

    • memory/4772-63-0x00000000028E0000-0x000000000291A000-memory.dmp

      Filesize

      232KB

    • memory/4772-856-0x00000000079C0000-0x0000000007FD8000-memory.dmp

      Filesize

      6.1MB

    • memory/4772-857-0x0000000002B10000-0x0000000002B22000-memory.dmp

      Filesize

      72KB

    • memory/4772-858-0x0000000007FE0000-0x00000000080EA000-memory.dmp

      Filesize

      1.0MB

    • memory/4772-62-0x00000000027E0000-0x000000000281C000-memory.dmp

      Filesize

      240KB

    • memory/4772-860-0x00000000025B0000-0x00000000025FC000-memory.dmp

      Filesize

      304KB