Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:42

General

  • Target

    485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe

  • Size

    1.2MB

  • MD5

    e17df373234ce97c9e074acbac058795

  • SHA1

    54ee6053bd686cde7a12438f86a0c57c7e33f896

  • SHA256

    485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190

  • SHA512

    4f711d3048f3c8276a861627c473ae8786fd2b39f8254905396f5eebdbf331ec361412a30d8cc43f310c5e897b322dc3e0742c400e7b02b95b807033dc2733b4

  • SSDEEP

    24576:CO/ma41pNBrquMHuDpKqJUd5xYsLo11YdH/tFrQhldU8HJVYx+dblqaWSLO:COXedEODpKqJGYsLMutFEIx257

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe
    "C:\Users\Admin\AppData\Local\Temp\485e53e53602c4fad71d3b2a7b8e6e3bec7af1cea1f5a7af72b15664392d1190.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5028
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1080
            5⤵
            • Program crash
            PID:3288
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2028
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5028 -ip 5028
    1⤵
      PID:2832

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zB017841.exe

      Filesize

      763KB

      MD5

      f29d111c772c23c3f519a3a2fc3f08b6

      SHA1

      268dc2b2e4f513d4413fad9368bc4e5d373e81eb

      SHA256

      8051db68eba1bfc0d5b55749ddf5280b7070568597253ac8ea0e733184e0847e

      SHA512

      f8a8524eb76e1a8e59c3d88b47f958c9f18b352cab81964bf899daff2bf363f56d14e87f3fde0e93a59ce721f3308cb036cac6b482a97227d5811f35f4818c8b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TM820372.exe

      Filesize

      592KB

      MD5

      0334faee3c8f458beda101583d670322

      SHA1

      431c0120f423c32af37a40b2b03bf4ff2831efcd

      SHA256

      66fbb89f1429d0fd5bb215cd30a3181c59dcc6553558b79367fc6d217f1f4ddb

      SHA512

      80a4f2944ceb2962587b30aa258c257ce5fb5347d7e69ae6dfa0921a11086f1064b2421e9d46802852b596b412785935c7ad7639701ba8a0b94f7c27a8be0506

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\122174453.exe

      Filesize

      377KB

      MD5

      83f564c1ed3c578458a63a80a09e3133

      SHA1

      f85f3afbdf8ef9240e9d62d663202e52649742de

      SHA256

      c42d6dfe8ce27758b60ffab1d4111283fa33d0d0616b47ceacb9008470011ed0

      SHA512

      17ca918909711c5d6c0b82844e9f34c2d1f174463ad6dd570e4fb86726917872f513fe8b19dc5e36adbbb0fe4fb911c6e22d3d7459a91a5e5befa10eeb4f12ef

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\200793949.exe

      Filesize

      459KB

      MD5

      573ebefdb8312b08d981837af4379aa5

      SHA1

      c4c2f5b56ed38c2bff5d35546fd9f269825f9e78

      SHA256

      d499c5d2fbdc354790c269b27ab6c1be31368c93f386053415cb5877e47694e4

      SHA512

      52d3014f63ad1b3c571a9df6a61a66f107c4dfc96d13c34d129907527dc29b03854a7dcf41295aad696692f430348b0109035026f24f25dfc3c03ecc41f0236a

    • memory/1996-59-0x00000000026D0000-0x00000000027DA000-memory.dmp

      Filesize

      1.0MB

    • memory/1996-2-0x00000000027E0000-0x00000000028E6000-memory.dmp

      Filesize

      1.0MB

    • memory/1996-3-0x0000000000400000-0x0000000000509000-memory.dmp

      Filesize

      1.0MB

    • memory/1996-1-0x00000000026D0000-0x00000000027DA000-memory.dmp

      Filesize

      1.0MB

    • memory/1996-62-0x0000000000400000-0x00000000008E0000-memory.dmp

      Filesize

      4.9MB

    • memory/1996-61-0x0000000000400000-0x0000000000509000-memory.dmp

      Filesize

      1.0MB

    • memory/1996-60-0x00000000027E0000-0x00000000028E6000-memory.dmp

      Filesize

      1.0MB

    • memory/2028-104-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-96-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-869-0x00000000025F0000-0x000000000263C000-memory.dmp

      Filesize

      304KB

    • memory/2028-868-0x00000000080E0000-0x000000000811C000-memory.dmp

      Filesize

      240KB

    • memory/2028-867-0x0000000007FD0000-0x00000000080DA000-memory.dmp

      Filesize

      1.0MB

    • memory/2028-866-0x0000000007FB0000-0x0000000007FC2000-memory.dmp

      Filesize

      72KB

    • memory/2028-865-0x0000000007950000-0x0000000007F68000-memory.dmp

      Filesize

      6.1MB

    • memory/2028-80-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-82-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-84-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-86-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-90-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-92-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-94-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-98-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-100-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-106-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-102-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-73-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-74-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-76-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-78-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/2028-71-0x00000000026C0000-0x00000000026FC000-memory.dmp

      Filesize

      240KB

    • memory/2028-72-0x0000000005450000-0x000000000548A000-memory.dmp

      Filesize

      232KB

    • memory/2028-88-0x0000000005450000-0x0000000005485000-memory.dmp

      Filesize

      212KB

    • memory/5028-34-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-63-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/5028-36-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-28-0x0000000002630000-0x000000000264A000-memory.dmp

      Filesize

      104KB

    • memory/5028-29-0x0000000004F50000-0x00000000054F4000-memory.dmp

      Filesize

      5.6MB

    • memory/5028-30-0x0000000004DB0000-0x0000000004DC8000-memory.dmp

      Filesize

      96KB

    • memory/5028-26-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/5028-31-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-38-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-56-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-54-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-66-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/5028-32-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-40-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-58-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-42-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-44-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-46-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-48-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-50-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-52-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

      Filesize

      72KB

    • memory/5028-27-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB