Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:37

General

  • Target

    0c917aadd93b36059c7b37cd67e94d04b2ae6ea6588c186df7ecd4ef46d0429e.exe

  • Size

    751KB

  • MD5

    e4b1bf53f0d007059cb74594933a6811

  • SHA1

    7e6fd0ac3a3e4ac728156030864a75504397c8b2

  • SHA256

    0c917aadd93b36059c7b37cd67e94d04b2ae6ea6588c186df7ecd4ef46d0429e

  • SHA512

    7fb42058ba73357dfd4cd1041e121fb7e52748309a3840f555375a2b4322e385ffbb73e7e4752e22cc471b28d531b5da1087d741f30de927249074785ab65231

  • SSDEEP

    12288:Py90Di6WpZBupXTAB7xxmKIVYWaxaEL0eTrl30MPuxmvtIEC4gZRvFJlQ4yNCUuK:PysWHsTAt6KIutxa4Trt4qC3ZJNwNC+x

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c917aadd93b36059c7b37cd67e94d04b2ae6ea6588c186df7ecd4ef46d0429e.exe
    "C:\Users\Admin\AppData\Local\Temp\0c917aadd93b36059c7b37cd67e94d04b2ae6ea6588c186df7ecd4ef46d0429e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un603417.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un603417.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97657439.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97657439.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1304
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk653019.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk653019.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un603417.exe

    Filesize

    597KB

    MD5

    500e06569ccba6d2e3f07b83de33dcd6

    SHA1

    285b78bf7cb2df54124adbe46770c3a77d308f0e

    SHA256

    5af465c97bdf9d54d6d0d79ce7e5768db23c63700a6d28fdf43fb82d5c6b5a47

    SHA512

    c10a3d8eac4e3975a45ba3843429f86fd95f59708ca3d75edaa2f74cbdb74a5787c26161aff60d8d6d04bc031a91bd2633893bfb456a60b261ced407bc0862da

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\97657439.exe

    Filesize

    377KB

    MD5

    46b5b926bdcb581190d1a0da7a9c2a83

    SHA1

    9c251e4903dd9d38d4934c5de1c696355e46b477

    SHA256

    8c35a87a3b8a42e8f6e7bfb84b6032b27cdb268701f2d74b3cae7de323080b49

    SHA512

    f11732d463e752702e6019584260f51954622876b264f9ef51484559b4d814ef7221e63f60dfb4e46a3ac1ced0c18fe9a3f9c45f43250339d45d7c731868eded

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk653019.exe

    Filesize

    459KB

    MD5

    0cf7bd91b621dece512d193d5af877e5

    SHA1

    10c5301f32d916893860f77486aa63b7ee4e1150

    SHA256

    2302d9ccb137211a19517d77f0b83c5378aeaa36b423ba853e947f11412f8163

    SHA512

    4cec0173b3737d7f5372f7fa1099aceb802d226092d4d4e175d0e8d7e1ddec7921ab6ea551ce52591982a9277d2446839fe7ee3a024e3d32b06714fc48fd76b0

  • memory/1304-15-0x0000000000930000-0x0000000000A30000-memory.dmp

    Filesize

    1024KB

  • memory/1304-16-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1304-17-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/1304-18-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/1304-19-0x0000000002880000-0x000000000289A000-memory.dmp

    Filesize

    104KB

  • memory/1304-20-0x0000000004F40000-0x00000000054E4000-memory.dmp

    Filesize

    5.6MB

  • memory/1304-21-0x0000000004DB0000-0x0000000004DC8000-memory.dmp

    Filesize

    96KB

  • memory/1304-41-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-49-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-47-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-45-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-43-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-39-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-37-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-35-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-33-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-31-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-29-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-27-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-23-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-25-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-22-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

    Filesize

    72KB

  • memory/1304-50-0x0000000000930000-0x0000000000A30000-memory.dmp

    Filesize

    1024KB

  • memory/1304-51-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1304-54-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/1304-55-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/4940-60-0x0000000002830000-0x000000000286C000-memory.dmp

    Filesize

    240KB

  • memory/4940-61-0x0000000004DF0000-0x0000000004E2A000-memory.dmp

    Filesize

    232KB

  • memory/4940-79-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-83-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-81-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-95-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-93-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-89-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-87-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-85-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-77-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-75-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-73-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-91-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-71-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-69-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-67-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-65-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-63-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-62-0x0000000004DF0000-0x0000000004E25000-memory.dmp

    Filesize

    212KB

  • memory/4940-854-0x0000000007900000-0x0000000007F18000-memory.dmp

    Filesize

    6.1MB

  • memory/4940-855-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

    Filesize

    72KB

  • memory/4940-856-0x0000000007FC0000-0x00000000080CA000-memory.dmp

    Filesize

    1.0MB

  • memory/4940-857-0x00000000080E0000-0x000000000811C000-memory.dmp

    Filesize

    240KB

  • memory/4940-858-0x00000000048A0000-0x00000000048EC000-memory.dmp

    Filesize

    304KB