Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:24

General

  • Target

    974179c039d9a6147125e32791453a673f59bab9c78b1c45b947428c4bcbcb3d.exe

  • Size

    696KB

  • MD5

    309939e34ce44f7680958a7409f6dccb

  • SHA1

    123a643a3d8c6ae1c006752f1ec7beb0b5a6d5d1

  • SHA256

    974179c039d9a6147125e32791453a673f59bab9c78b1c45b947428c4bcbcb3d

  • SHA512

    832451b327586d6bd38ca4945a49cf053804eba5f5b8c743b24f9cca2b5c28b7bd135553b67ff48742fa891e89f4768be4736958a5d9112cc7066c05ae2f5d3f

  • SSDEEP

    12288:4y90CuuZk6QiE8ztYjrwBSlDTPni5SOv4Kc/mKYKDShBzEFTn1tsudVJrfRSB2Y:4yXuT6QiEKyjCSlPi5SOvdcloSRuuk

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\974179c039d9a6147125e32791453a673f59bab9c78b1c45b947428c4bcbcb3d.exe
    "C:\Users\Admin\AppData\Local\Temp\974179c039d9a6147125e32791453a673f59bab9c78b1c45b947428c4bcbcb3d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un772521.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un772521.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3104
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr037066.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr037066.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4028
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 1080
          4⤵
          • Program crash
          PID:3504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu521123.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu521123.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4896
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4028 -ip 4028
    1⤵
      PID:1832

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un772521.exe

      Filesize

      542KB

      MD5

      9cb1dc8eeb51c4c3c61928fa213c6714

      SHA1

      e8a5f3322602134620f2163cd04772f4833cbe92

      SHA256

      20296bc2f11ee9ce322e6e7b95b1704b01072c749e90bfc3484103bd25eea075

      SHA512

      6ac495114c86a1d2c2e7fb43c1666d1be0e4c07cdb78bc2ae0ea9b4d9296f9a12e1f24421040c8333506dc1ff1316f3f2664d31913efe24a8103004a598ec7a2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr037066.exe

      Filesize

      270KB

      MD5

      e5c05386cf2ef6075305fe1d8e7a1386

      SHA1

      9c63ceae8cd9e9af73adea42486291274b0763af

      SHA256

      40ff2407e0d3739c4d1f064d89259fe6ce3cbd7c9ed1c55ee19ca96fec72f6a9

      SHA512

      7995b17e885e474a1a311979d3537c77910c221614d703bb662f6a85fc833b33d32645f739c50b4ed51339204f17d03e98e94f360532b2e7d94a8becc22923c3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu521123.exe

      Filesize

      353KB

      MD5

      ced15185bcc6faf420bdfc9a9c9ea18a

      SHA1

      ad48d31755274793d18af6bc838b4e5fdcda2a95

      SHA256

      c0bce2281a8f3a6525dced113ea08876e26a9e282d49db3cbf83403930658fd4

      SHA512

      59d0a7d429eac1a7f5b4cfe8fd0955e84b0f03f71c680e83d596f7794a6cc8831e5307c3089f2fe93fcf95cc5cf6361312ecd93b92ad31a63590c001aacc30f1

    • memory/4028-15-0x0000000002D90000-0x0000000002E90000-memory.dmp

      Filesize

      1024KB

    • memory/4028-16-0x0000000002C90000-0x0000000002CBD000-memory.dmp

      Filesize

      180KB

    • memory/4028-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4028-18-0x0000000004BC0000-0x0000000004BDA000-memory.dmp

      Filesize

      104KB

    • memory/4028-19-0x0000000007210000-0x00000000077B4000-memory.dmp

      Filesize

      5.6MB

    • memory/4028-20-0x0000000007140000-0x0000000007158000-memory.dmp

      Filesize

      96KB

    • memory/4028-48-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-46-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-44-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-42-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-40-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-38-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-36-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-34-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-32-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-30-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-28-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-26-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-24-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-22-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-21-0x0000000007140000-0x0000000007152000-memory.dmp

      Filesize

      72KB

    • memory/4028-49-0x0000000002D90000-0x0000000002E90000-memory.dmp

      Filesize

      1024KB

    • memory/4028-51-0x0000000002C90000-0x0000000002CBD000-memory.dmp

      Filesize

      180KB

    • memory/4028-50-0x0000000000400000-0x0000000002BAD000-memory.dmp

      Filesize

      39.7MB

    • memory/4028-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4028-55-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4028-54-0x0000000000400000-0x0000000002BAD000-memory.dmp

      Filesize

      39.7MB

    • memory/4896-60-0x00000000049A0000-0x00000000049DC000-memory.dmp

      Filesize

      240KB

    • memory/4896-61-0x0000000004C50000-0x0000000004C8A000-memory.dmp

      Filesize

      232KB

    • memory/4896-65-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-71-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-95-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-93-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-91-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-89-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-87-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-85-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-83-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-81-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-79-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-77-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-75-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-73-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-69-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-67-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-63-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-62-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/4896-854-0x0000000009CD0000-0x000000000A2E8000-memory.dmp

      Filesize

      6.1MB

    • memory/4896-855-0x000000000A350000-0x000000000A362000-memory.dmp

      Filesize

      72KB

    • memory/4896-856-0x000000000A370000-0x000000000A47A000-memory.dmp

      Filesize

      1.0MB

    • memory/4896-857-0x000000000A490000-0x000000000A4CC000-memory.dmp

      Filesize

      240KB

    • memory/4896-858-0x0000000004A10000-0x0000000004A5C000-memory.dmp

      Filesize

      304KB