Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 03:25

General

  • Target

    f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe

  • Size

    652KB

  • MD5

    170304966f08a379d1fdd8b61bddfdc6

  • SHA1

    0a96b84514b44c8f8a5e052683e9111a2ccafe5f

  • SHA256

    f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291

  • SHA512

    a30a5142adc5d7dbe95f8dd832f3643aeabde848b0f1dde775b0efbad8e7757477905e948336d0eccbad558d26f3e724e52f71c2632d305635fe3fb9dceb6685

  • SSDEEP

    12288:8y90LUvjYwCnaa4eP9a4eER/IE/hxDzWZzRp3baTOAwb0:8yzvjX2P9+ERxxDzW1RZbaH

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe
    "C:\Users\Admin\AppData\Local\Temp\f4cf86e6971d55392f5856349d84ad2c220df3f1288b31cfb1c517da8d322291.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st594835.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st594835.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\76415258.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\76415258.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2868
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp639452.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp639452.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st594835.exe

    Filesize

    497KB

    MD5

    c32be658ad0ddbfa04cabdd5fb2bbd11

    SHA1

    96746c5f3b6eef3a66202d066b5ea06602c8f73c

    SHA256

    bd83887991305acef5189c3739a1ee544d25db8e5e01d6024ff33b2bf5797365

    SHA512

    c7e94773516e2c4485749f12ee93d78d4c193c0c5188710c4bd16bdd6a3551e0742f1d9b40a8d2c7e8829664bf0795fc8b5f433e5447562d713ac99852e49a4a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\76415258.exe

    Filesize

    175KB

    MD5

    a165b5f6b0a4bdf808b71de57bf9347d

    SHA1

    39a7b301e819e386c162a47e046fa384bb5ab437

    SHA256

    68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

    SHA512

    3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp639452.exe

    Filesize

    342KB

    MD5

    5a0611c64d614f69cd195b272df69aff

    SHA1

    495e4ba6bbb7fec824035b93328789037591f25e

    SHA256

    3a60fa9cff97a6096a11e67bc724a607b39c402c0aa7086354cb0766fac13bab

    SHA512

    2f5590ef384abe57dbe582ee67e5e4f92389cd30a3033034b0bc8522efba13ee147e8796de9f6df0aa8e2e319a5f077cacc9cbf92ffbad75ae15fff39792b6d3

  • memory/1936-70-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-76-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-852-0x0000000004B90000-0x0000000004BA2000-memory.dmp

    Filesize

    72KB

  • memory/1936-851-0x0000000007610000-0x0000000007C28000-memory.dmp

    Filesize

    6.1MB

  • memory/1936-59-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-60-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-62-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-64-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-67-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-68-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-854-0x0000000007D40000-0x0000000007D7C000-memory.dmp

    Filesize

    240KB

  • memory/1936-58-0x0000000004A50000-0x0000000004A8A000-memory.dmp

    Filesize

    232KB

  • memory/1936-74-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-853-0x0000000007C30000-0x0000000007D3A000-memory.dmp

    Filesize

    1.0MB

  • memory/1936-78-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-82-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-84-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-86-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-88-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-90-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-92-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-94-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-80-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-72-0x0000000004A50000-0x0000000004A85000-memory.dmp

    Filesize

    212KB

  • memory/1936-855-0x00000000023D0000-0x000000000241C000-memory.dmp

    Filesize

    304KB

  • memory/1936-57-0x0000000002480000-0x00000000024BC000-memory.dmp

    Filesize

    240KB

  • memory/2868-40-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-52-0x0000000073F20000-0x00000000746D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2868-50-0x0000000073F20000-0x00000000746D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2868-49-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

    Filesize

    4KB

  • memory/2868-21-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-22-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-24-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-26-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-28-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-30-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-32-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-34-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-36-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-38-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-42-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-44-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-46-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-48-0x0000000004AC0000-0x0000000004AD3000-memory.dmp

    Filesize

    76KB

  • memory/2868-20-0x0000000073F20000-0x00000000746D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2868-18-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

    Filesize

    96KB

  • memory/2868-19-0x0000000073F20000-0x00000000746D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2868-17-0x0000000004CA0000-0x0000000005244000-memory.dmp

    Filesize

    5.6MB

  • memory/2868-16-0x0000000073F20000-0x00000000746D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2868-15-0x00000000025A0000-0x00000000025BA000-memory.dmp

    Filesize

    104KB

  • memory/2868-14-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

    Filesize

    4KB