Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 02:05

General

  • Target

    2dd3cd6cb382602eea9e0526c49a9b91d127aa2bdac315ec216bec6e6b83e0c3.exe

  • Size

    479KB

  • MD5

    ca8d7a0661410bf79dfc807242fdae5d

  • SHA1

    28c435f3d48db88296d938cbfd48c3876e1319e5

  • SHA256

    2dd3cd6cb382602eea9e0526c49a9b91d127aa2bdac315ec216bec6e6b83e0c3

  • SHA512

    94395083679c0fcbff8da7270fc70ad630403fe47c42ecb7ec5cde7e01c2f047a5e01fde5c9142a3cbce506ddfa41b46b528c887fcabf633cd4c24de83e97bad

  • SSDEEP

    12288:VMrqy908SCutxrXRDR8wt5kLQQbX5eD/YOHPiTU:fyDSPhfG/peDwOL

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dd3cd6cb382602eea9e0526c49a9b91d127aa2bdac315ec216bec6e6b83e0c3.exe
    "C:\Users\Admin\AppData\Local\Temp\2dd3cd6cb382602eea9e0526c49a9b91d127aa2bdac315ec216bec6e6b83e0c3.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8614845.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8614845.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3605247.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3605247.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2424
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8687869.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8687869.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8614845.exe

    Filesize

    307KB

    MD5

    b4c43a1e60e00e171ca62e619db2535b

    SHA1

    8e9fa77173df4d83d779cfd78015072ce8514aaf

    SHA256

    4023883d1c7ff4edc7598924065033f3ca86a465e54259efbdc6751d5de14f5a

    SHA512

    28f23dfb2bd16258e0ec2f34eec3e146f0b87a35909b73b1a23ab0a2fdb4dd31bfcbf1648d3201d1adbe7c2b9b90e047705a95141ad45c9348b7af84626ad7ea

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3605247.exe

    Filesize

    175KB

    MD5

    debf3046e1cd137d50c54602f9c82451

    SHA1

    9443adf1fdc055c629650638aa43cdce5d0c2258

    SHA256

    28c5bb5bbe53c2c791e175a2647e55b5660d95fb530d774502cd13130f46512b

    SHA512

    e1b1c9b3b3600a808448100d94f3e0618c97b2eff92472efe122d378d5b030b10b4d6b5cce11bb7107e944f0ae2c973544fb245985c210a670e906e0455dff80

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8687869.exe

    Filesize

    137KB

    MD5

    e01341871106094e8cdf0f49c7800369

    SHA1

    6d2c17a7ff9037f4e0834998946f29b59fb2bf18

    SHA256

    1627fba719a0532e9de3309a3d08e01378f87ad934cb78c16d6ebf9ee8e0a0a7

    SHA512

    a1fb562757d8956983aea2e06f2ede71b978a24dc5afe56ded11e4ca372da3750e130a807572c5094688a7ffec450248e3bc7ea3cf4106f49453e7c39d42b9b5

  • memory/2424-34-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-50-0x0000000073E80000-0x0000000074630000-memory.dmp

    Filesize

    7.7MB

  • memory/2424-32-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-18-0x0000000073E80000-0x0000000074630000-memory.dmp

    Filesize

    7.7MB

  • memory/2424-19-0x0000000073E80000-0x0000000074630000-memory.dmp

    Filesize

    7.7MB

  • memory/2424-20-0x00000000023A0000-0x00000000023B8000-memory.dmp

    Filesize

    96KB

  • memory/2424-42-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-48-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-46-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-44-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-40-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-38-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-36-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-15-0x00000000020A0000-0x00000000020BA000-memory.dmp

    Filesize

    104KB

  • memory/2424-17-0x0000000004BE0000-0x0000000005184000-memory.dmp

    Filesize

    5.6MB

  • memory/2424-30-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-16-0x0000000073E80000-0x0000000074630000-memory.dmp

    Filesize

    7.7MB

  • memory/2424-26-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-24-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-22-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-21-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-49-0x0000000073E8E000-0x0000000073E8F000-memory.dmp

    Filesize

    4KB

  • memory/2424-28-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

  • memory/2424-52-0x0000000073E80000-0x0000000074630000-memory.dmp

    Filesize

    7.7MB

  • memory/2424-14-0x0000000073E8E000-0x0000000073E8F000-memory.dmp

    Filesize

    4KB

  • memory/4880-56-0x00000000007B0000-0x00000000007D8000-memory.dmp

    Filesize

    160KB

  • memory/4880-57-0x0000000007BC0000-0x00000000081D8000-memory.dmp

    Filesize

    6.1MB

  • memory/4880-58-0x0000000007650000-0x0000000007662000-memory.dmp

    Filesize

    72KB

  • memory/4880-59-0x0000000007780000-0x000000000788A000-memory.dmp

    Filesize

    1.0MB

  • memory/4880-60-0x00000000076E0000-0x000000000771C000-memory.dmp

    Filesize

    240KB

  • memory/4880-61-0x0000000007720000-0x000000000776C000-memory.dmp

    Filesize

    304KB