Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:30

General

  • Target

    f00f90730a46228e0bab05ff077aebfdfb79165fc096655d13f30584409659fd.exe

  • Size

    558KB

  • MD5

    c0583367913cb3bfacec39190df16ae5

  • SHA1

    1db6cda937e2d14c628bc885bbae2527a649ca7e

  • SHA256

    f00f90730a46228e0bab05ff077aebfdfb79165fc096655d13f30584409659fd

  • SHA512

    847a2286faafe0b54a77d626583a434c26b5e1d0f14ae45a1b0189ce6f97deb54a9eac0f6130d716623775ebb2f836f17e061855c0228094b1c8a636dbea0a86

  • SSDEEP

    12288:ey90D6z6bdu8T57RHHJeNFps6BpDomaixIB7FyEOysYg:eyfz6b9T57RJefMwO+J

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f00f90730a46228e0bab05ff077aebfdfb79165fc096655d13f30584409659fd.exe
    "C:\Users\Admin\AppData\Local\Temp\f00f90730a46228e0bab05ff077aebfdfb79165fc096655d13f30584409659fd.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCr8364.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCr8364.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4020
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it536340.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it536340.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3460
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp113535.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp113535.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4044
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:4968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCr8364.exe

    Filesize

    404KB

    MD5

    ac5886eb0ebc43d5c022431a1c94c9dd

    SHA1

    8244c9b797d0e34cf0beb6e07d62b8847c97ba71

    SHA256

    b592b6b48be8d278672f3614d897df1e2f6cabbdb59b0fdf50bfc16c05d4f23d

    SHA512

    450c1cc1634e429d1454b85f7c71c8b56affae7ff0a890331f5258289dfadbc0cfeff2cb22c6da6acca8f5d2288a42cb8387fa616ddbc48621a5aa7d4516326d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it536340.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp113535.exe

    Filesize

    361KB

    MD5

    cb41cf3cdf4fee8b28ae2861126de2c5

    SHA1

    2f70081cc9cf83ba05ca75320747bf90f5d82e96

    SHA256

    6e1c8b51203213b6fb39942e0107ee9afc076dfda40af82e1fb603dfdabbd415

    SHA512

    b6a6d93e849142a6a1cb21d3e50b7cfe06f62a7cc70d4706a9cc9067c4febe2f90814ef841b57363c622eab41ea3fbb2f46492b40e83ec7f2f7142cd722ff100

  • memory/3460-14-0x00007FFCEC9E3000-0x00007FFCEC9E5000-memory.dmp

    Filesize

    8KB

  • memory/3460-15-0x0000000000A10000-0x0000000000A1A000-memory.dmp

    Filesize

    40KB

  • memory/3460-16-0x00007FFCEC9E3000-0x00007FFCEC9E5000-memory.dmp

    Filesize

    8KB

  • memory/4044-78-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-66-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-24-0x00000000072F0000-0x000000000732A000-memory.dmp

    Filesize

    232KB

  • memory/4044-32-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-34-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-82-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-70-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-54-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-30-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-28-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-26-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-25-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-88-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-86-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-84-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-80-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-22-0x0000000007270000-0x00000000072AC000-memory.dmp

    Filesize

    240KB

  • memory/4044-76-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-75-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-72-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-68-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-23-0x0000000007430000-0x00000000079D4000-memory.dmp

    Filesize

    5.6MB

  • memory/4044-64-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-62-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-60-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-58-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-56-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-52-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-50-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-48-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-46-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-44-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-42-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-40-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-38-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-36-0x00000000072F0000-0x0000000007325000-memory.dmp

    Filesize

    212KB

  • memory/4044-819-0x000000000A4A0000-0x000000000A5AA000-memory.dmp

    Filesize

    1.0MB

  • memory/4044-818-0x000000000A480000-0x000000000A492000-memory.dmp

    Filesize

    72KB

  • memory/4044-817-0x0000000009E60000-0x000000000A478000-memory.dmp

    Filesize

    6.1MB

  • memory/4044-820-0x000000000A5D0000-0x000000000A60C000-memory.dmp

    Filesize

    240KB

  • memory/4044-821-0x0000000006DA0000-0x0000000006DEC000-memory.dmp

    Filesize

    304KB