Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:36

General

  • Target

    82b31d393153b2f47d9e7ed44d9d61943a98478062daace89a7ded14cab6da3b.exe

  • Size

    480KB

  • MD5

    43b711737890e8b32478390a94d651ee

  • SHA1

    73dfc6228a32a6c11a3b3b97a2c4602c318a6d32

  • SHA256

    82b31d393153b2f47d9e7ed44d9d61943a98478062daace89a7ded14cab6da3b

  • SHA512

    25fdc9980995f8a00426edd16854fb7eca4bd4637bbbf4233dc32785419d21c1eeb24af95e09ed5b58b616124959420ca2ba36f0b5f0ce936d8fcc88f684b33b

  • SSDEEP

    12288:JMrhy909sJqa9F4LEDjCEPvKQenP4hdWOLDLUyy4:Yy67aYLmCWviCZDLUm

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82b31d393153b2f47d9e7ed44d9d61943a98478062daace89a7ded14cab6da3b.exe
    "C:\Users\Admin\AppData\Local\Temp\82b31d393153b2f47d9e7ed44d9d61943a98478062daace89a7ded14cab6da3b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0670110.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0670110.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4481314.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4481314.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4448
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7636927.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7636927.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0670110.exe

    Filesize

    308KB

    MD5

    c3fa2d0d717ac45cb2a29621d0861b03

    SHA1

    92b2caa17b1de587131039297dc9c27e24f128f0

    SHA256

    afd7c5efec0d1a8c660642759dc1b16d902e7edb97c637b263871ecb49f64d42

    SHA512

    d8f15e29279b0cc7e4dc5989967e07aaaa6419a9399420d68696dc06d19e0990dba2daa3fa0180d7e1dd816ac4846c82d6641df22ebc74507b20724896a1defe

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k4481314.exe

    Filesize

    175KB

    MD5

    ba2004d0f8427485e672ac607c9874f4

    SHA1

    8b9fd4040f5d74e106c8e3cb16fe6956951929df

    SHA256

    796a305eb569ad3632153acd4352173937cca11d5ededa1ae208f386b5c78d84

    SHA512

    644bdf807a73f7e1fedeeda48273d737d954c149cf7fc3d6a33c2fd212c88cf74fd4a71f855096049f5c416c810789fb670e7521f77d77d937d6ef96c4aa5c1b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l7636927.exe

    Filesize

    136KB

    MD5

    baced8ac7fcd7922cb9fac0d54da33b4

    SHA1

    20b7db9150687cc1fcfbf534c6d7d519a7e399cc

    SHA256

    287e4f73c0b8881040446d3054c8220d23b1bcd6f7ad37c7ffd1c389a4f8b215

    SHA512

    59190b14619c6f5a22358fdd77f41279c045f743ac4d7961f0df8f9c5c82343409856397409e7dd5ae8ffc8d0cd9fe3369b8d30eacf4501ad9f900fd431b2187

  • memory/3136-61-0x0000000007C70000-0x0000000007CBC000-memory.dmp

    Filesize

    304KB

  • memory/3136-60-0x0000000007CD0000-0x0000000007D0C000-memory.dmp

    Filesize

    240KB

  • memory/3136-59-0x0000000007D60000-0x0000000007E6A000-memory.dmp

    Filesize

    1.0MB

  • memory/3136-58-0x0000000007BF0000-0x0000000007C02000-memory.dmp

    Filesize

    72KB

  • memory/3136-57-0x0000000008180000-0x0000000008798000-memory.dmp

    Filesize

    6.1MB

  • memory/3136-56-0x0000000000ED0000-0x0000000000EF8000-memory.dmp

    Filesize

    160KB

  • memory/4448-30-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-19-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-40-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-38-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-36-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-34-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-32-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-47-0x0000000073FA0000-0x0000000074750000-memory.dmp

    Filesize

    7.7MB

  • memory/4448-28-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-26-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-24-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-22-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-20-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-42-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-48-0x0000000073FA0000-0x0000000074750000-memory.dmp

    Filesize

    7.7MB

  • memory/4448-49-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

    Filesize

    4KB

  • memory/4448-50-0x0000000073FA0000-0x0000000074750000-memory.dmp

    Filesize

    7.7MB

  • memory/4448-52-0x0000000073FA0000-0x0000000074750000-memory.dmp

    Filesize

    7.7MB

  • memory/4448-44-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-46-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

    Filesize

    72KB

  • memory/4448-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

    Filesize

    96KB

  • memory/4448-17-0x0000000004B70000-0x0000000005114000-memory.dmp

    Filesize

    5.6MB

  • memory/4448-16-0x0000000073FA0000-0x0000000074750000-memory.dmp

    Filesize

    7.7MB

  • memory/4448-15-0x00000000023F0000-0x000000000240A000-memory.dmp

    Filesize

    104KB

  • memory/4448-14-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

    Filesize

    4KB