Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:41

General

  • Target

    f956e2bd7187f8a2882939d999954d2319b8d3134ad038d8fca437582ab0801f.exe

  • Size

    1.0MB

  • MD5

    73027f8d9a6ff64c87c429cd07c47244

  • SHA1

    240810cc531ce32fbe64c10bc3dd99ccea7d7cc0

  • SHA256

    f956e2bd7187f8a2882939d999954d2319b8d3134ad038d8fca437582ab0801f

  • SHA512

    bd5e8be9016059524b32ebf364b8c0cda20849da35ba38d53e033b624ed5b28387b6c85a9e59c473600703f421f8e12e6c44e2e70ab967acb8293c325e216eab

  • SSDEEP

    24576:uygcF+4H/Do1xUjeTl/hYFlYe0p5f6tx1heHZcquSgoVry7S0U5:9bFBH/yTRyF5UxKveHZcquSx+

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f956e2bd7187f8a2882939d999954d2319b8d3134ad038d8fca437582ab0801f.exe
    "C:\Users\Admin\AppData\Local\Temp\f956e2bd7187f8a2882939d999954d2319b8d3134ad038d8fca437582ab0801f.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un645539.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un645539.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un598146.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un598146.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:64
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr564847.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr564847.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3684
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 1080
            5⤵
            • Program crash
            PID:2980
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu662810.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu662810.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3684 -ip 3684
    1⤵
      PID:2748

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un645539.exe

      Filesize

      761KB

      MD5

      efb29d10eef945d0b60d8e1d0d1a5b4e

      SHA1

      335fea5e6a48c56e4d7cd75fa27a1c199c93c34f

      SHA256

      431b4a261b8620c58a7d5ea28e4be10731b653018dda0e2f9d2c470946048e50

      SHA512

      a6380ce99078927159295b51af1e5f2a4cecd5f1c34624480391a9bba5395c67c1826feef7b13ec31be465790d274a292a4fdc10373e806c7cc82e22b9f4575f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un598146.exe

      Filesize

      608KB

      MD5

      6f2e71401e9e8b8fa83f85c2bf0de6b2

      SHA1

      99fd01de82ab358aa1a251b89cba4c34a3203252

      SHA256

      539f2c324cb2eee7088f5ad1cb443664c58fa5c27d68d93c6efc56f3336eeef0

      SHA512

      e67c9ea189260ac45e7c1a09f8b50c3d0d8892048a56df446ea0720cc6d3ab0dfeacac53d4188a013a4a449da0fb156b91e766738ac886330b5cfdd2abd2f76c

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr564847.exe

      Filesize

      405KB

      MD5

      01c41f190bf327c37677356e4ccda4de

      SHA1

      09fcbb1fa2c725f55240033ab48d0391712a24dd

      SHA256

      7a29ea8ba012cbcbde4cfe130c74a6a3555d1c12fc015d859d7b08d304d22892

      SHA512

      d07f6ff6dd9df77608c64af8c19f96cae7866bf1d069737e90082e8063fd22afa9e0545ff282e1432bae5a0df9409719e392589abcf51149a361543e11a6c083

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu662810.exe

      Filesize

      487KB

      MD5

      72d7581b67d8afe20659c399c6c18113

      SHA1

      83c28ace1bb02540bc70880af7669b041c940bf1

      SHA256

      7ac53bc803fd8f957e6f09939c141e6b372e64aff766f597c9a8a907eb996e7a

      SHA512

      4b4863fbb47cecf44dd822729bffd7fc24d7bbb74acf7fd2db737e3289710741673b1eb845881bffe3118e68548d9ce6d8920d08234c70a0a4d2fb8773e2168b

    • memory/1380-73-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-79-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-856-0x00000000079D0000-0x0000000007FE8000-memory.dmp

      Filesize

      6.1MB

    • memory/1380-857-0x0000000005050000-0x0000000005062000-memory.dmp

      Filesize

      72KB

    • memory/1380-64-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-65-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-89-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-67-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-859-0x0000000008100000-0x000000000813C000-memory.dmp

      Filesize

      240KB

    • memory/1380-71-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-85-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-75-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-77-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-858-0x0000000007FF0000-0x00000000080FA000-memory.dmp

      Filesize

      1.0MB

    • memory/1380-81-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-83-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-87-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-91-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-94-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-95-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-860-0x00000000025B0000-0x00000000025FC000-memory.dmp

      Filesize

      304KB

    • memory/1380-97-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/1380-62-0x00000000027B0000-0x00000000027EC000-memory.dmp

      Filesize

      240KB

    • memory/1380-63-0x0000000002880000-0x00000000028BA000-memory.dmp

      Filesize

      232KB

    • memory/1380-69-0x0000000002880000-0x00000000028B5000-memory.dmp

      Filesize

      212KB

    • memory/3684-45-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-57-0x0000000000400000-0x000000000080A000-memory.dmp

      Filesize

      4.0MB

    • memory/3684-54-0x0000000000400000-0x000000000080A000-memory.dmp

      Filesize

      4.0MB

    • memory/3684-55-0x0000000000900000-0x0000000000A00000-memory.dmp

      Filesize

      1024KB

    • memory/3684-29-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-31-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-26-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-27-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-33-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-35-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-37-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-41-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-43-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-47-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-49-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-51-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-53-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-39-0x0000000002A70000-0x0000000002A82000-memory.dmp

      Filesize

      72KB

    • memory/3684-25-0x0000000002A70000-0x0000000002A88000-memory.dmp

      Filesize

      96KB

    • memory/3684-24-0x0000000004F20000-0x00000000054C4000-memory.dmp

      Filesize

      5.6MB

    • memory/3684-23-0x0000000002850000-0x000000000286A000-memory.dmp

      Filesize

      104KB

    • memory/3684-22-0x0000000000900000-0x0000000000A00000-memory.dmp

      Filesize

      1024KB