Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 02:05

General

  • Target

    3240da0ac89450aab0a2d15f984bb0bd311b2f074db7fcb118226bdfa4f7667f.exe

  • Size

    612KB

  • MD5

    6ff7ac08be26162c889a63db2475b5fb

  • SHA1

    cc8691d3a5d95cb6f24506109b446a44a89da7be

  • SHA256

    3240da0ac89450aab0a2d15f984bb0bd311b2f074db7fcb118226bdfa4f7667f

  • SHA512

    ad767ad0ac519f5a91371af68a3ebb361aa61ef06474fcf72320da2aa671775218b21c7df11e2e5b9dda306ab95ba8f5e43c49bcbffd3e01a9527123c3950269

  • SSDEEP

    12288:iy90q5DY7UPszpENGt8ag6lirYLrf4kqgSTzIiZJb6LmuR:iyrD6lEoUJCrQBT8iZAR

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3240da0ac89450aab0a2d15f984bb0bd311b2f074db7fcb118226bdfa4f7667f.exe
    "C:\Users\Admin\AppData\Local\Temp\3240da0ac89450aab0a2d15f984bb0bd311b2f074db7fcb118226bdfa4f7667f.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st587075.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st587075.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02717049.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02717049.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3336
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp816907.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp816907.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st587075.exe

    Filesize

    457KB

    MD5

    d9671e240edd6fc3c76f09e3b6a11311

    SHA1

    b7913cab3c1a9a5ab6165065f597f4bb6cfd14e7

    SHA256

    5e1e669e8d43c8ffaa1dbc613867429f7c1020b2717be797fa2588a6a9890596

    SHA512

    438cbc944bbfd848cfbdf8a91d99102a6bb832ab3ee3ea3c980246711557615d0ce0cf6dafefafbe9d13800dec6006526a44909a65e4efdf07d7b877d141c71f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\02717049.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp816907.exe

    Filesize

    459KB

    MD5

    49d99ba9477b2da08ddd15609ce8db36

    SHA1

    5d034cb8dc6078ef49beaab8008b1b3b532d0758

    SHA256

    479d1f4e6bb0a6ffe2bdd2c7aede867128cdb01d3300815ca6d37db127f1bcc1

    SHA512

    345ea8c51869c696f6b888cad10bdcdb52becfb98740d9dae8d221e935d25d2ee71d2e5c92020e9e6c82808657bc25d606d2e60ac9a84ff216a867e9f3373e69

  • memory/3336-15-0x0000000000890000-0x000000000089A000-memory.dmp

    Filesize

    40KB

  • memory/3336-14-0x00007FFA1A923000-0x00007FFA1A925000-memory.dmp

    Filesize

    8KB

  • memory/3808-66-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-58-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-23-0x00000000028D0000-0x000000000290A000-memory.dmp

    Filesize

    232KB

  • memory/3808-83-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-87-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-85-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-81-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-79-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-77-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-817-0x0000000005180000-0x0000000005192000-memory.dmp

    Filesize

    72KB

  • memory/3808-818-0x0000000008150000-0x000000000825A000-memory.dmp

    Filesize

    1.0MB

  • memory/3808-816-0x0000000007B30000-0x0000000008148000-memory.dmp

    Filesize

    6.1MB

  • memory/3808-819-0x00000000051B0000-0x00000000051EC000-memory.dmp

    Filesize

    240KB

  • memory/3808-75-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-73-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-69-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-67-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-21-0x00000000025D0000-0x000000000260C000-memory.dmp

    Filesize

    240KB

  • memory/3808-63-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-61-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-59-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-22-0x0000000005200000-0x00000000057A4000-memory.dmp

    Filesize

    5.6MB

  • memory/3808-820-0x00000000024F0000-0x000000000253C000-memory.dmp

    Filesize

    304KB

  • memory/3808-55-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-51-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-49-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-47-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-46-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-41-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-39-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-37-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-35-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-33-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-31-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-71-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-53-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-43-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-29-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-27-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-25-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB

  • memory/3808-24-0x00000000028D0000-0x0000000002905000-memory.dmp

    Filesize

    212KB