Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:40

General

  • Target

    d5b9f9b52c0d5981b3b2d4127f9e265a69120746b0d9b841715a6beeb497606a.exe

  • Size

    569KB

  • MD5

    d638992d0105a5c94f2f88e541fc134a

  • SHA1

    3f31a3d351e6d4becf98e69f01599cada1dbb91f

  • SHA256

    d5b9f9b52c0d5981b3b2d4127f9e265a69120746b0d9b841715a6beeb497606a

  • SHA512

    373d2946078cacbc14d15ae555ed900fce01bfadb75cd8d150f4dbb8edfa3b0658564a59b900f4a5a868de4707b02e5a1c4f6d659ffdcd3d5798341eb702503b

  • SSDEEP

    12288:hy90D6n8EI6r+SEHV4zM5TV6xE9JSOdL86/eQ850zeBpjwk7eYR:hyM6n8EI2U4o5TwEP5zOj5wIeYR

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5b9f9b52c0d5981b3b2d4127f9e265a69120746b0d9b841715a6beeb497606a.exe
    "C:\Users\Admin\AppData\Local\Temp\d5b9f9b52c0d5981b3b2d4127f9e265a69120746b0d9b841715a6beeb497606a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziix1814.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziix1814.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it276708.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it276708.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp243365.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp243365.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziix1814.exe

    Filesize

    414KB

    MD5

    a0f8a3ff10e4f472f503f8ce60cbbdc0

    SHA1

    3c04017f3ccb96b0bec10f5a9bebc6f353a60deb

    SHA256

    f7107c49e77b832b3085feb1cb0afaff0d3626e269fedbb5463739a60349c2f6

    SHA512

    61302d650aae010d68a16c6a515ec0e18713f2c53062c1f4a0b068f2156b4213a77790cce0aa96f6f695e389ff96fcb1886e6df1de5242ba28e10d8c91cac803

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it276708.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp243365.exe

    Filesize

    362KB

    MD5

    e9150c5475d9c52ab4c98676bc1f3138

    SHA1

    6fcfa006226721ad7d1536bbcd140425fb783987

    SHA256

    be135fddad8baf2e6606fa891407c8d9ff2cc2ad25e4cf9be13326e47febe1e0

    SHA512

    2d0327496841f8b5af87ac70d65f5966a9f87f7eb95f1e6679c0daf7fd039dcdf36a1ded77aced434d136a1ec4364b9482ddb85f25de4963301b16c64d1321af

  • memory/2932-84-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-22-0x0000000007140000-0x000000000717C000-memory.dmp

    Filesize

    240KB

  • memory/2932-821-0x0000000004C10000-0x0000000004C5C000-memory.dmp

    Filesize

    304KB

  • memory/2932-78-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-23-0x00000000071D0000-0x0000000007774000-memory.dmp

    Filesize

    5.6MB

  • memory/2932-24-0x0000000007780000-0x00000000077BA000-memory.dmp

    Filesize

    232KB

  • memory/2932-32-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-38-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-36-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-34-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-82-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-64-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-76-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-30-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-28-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-26-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-25-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-88-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-86-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-820-0x000000000A4A0000-0x000000000A4DC000-memory.dmp

    Filesize

    240KB

  • memory/2932-80-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-819-0x000000000A370000-0x000000000A47A000-memory.dmp

    Filesize

    1.0MB

  • memory/2932-50-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-74-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-72-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-70-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-68-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-66-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-62-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-60-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-59-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-56-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-54-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-53-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-48-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-46-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-44-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-42-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-40-0x0000000007780000-0x00000000077B5000-memory.dmp

    Filesize

    212KB

  • memory/2932-817-0x0000000009C90000-0x000000000A2A8000-memory.dmp

    Filesize

    6.1MB

  • memory/2932-818-0x000000000A350000-0x000000000A362000-memory.dmp

    Filesize

    72KB

  • memory/4132-16-0x00007FFCD3813000-0x00007FFCD3815000-memory.dmp

    Filesize

    8KB

  • memory/4132-14-0x00007FFCD3813000-0x00007FFCD3815000-memory.dmp

    Filesize

    8KB

  • memory/4132-15-0x0000000000E40000-0x0000000000E4A000-memory.dmp

    Filesize

    40KB