Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 00:04

General

  • Target

    1d1572e265b303768aebc2ad4531521a6f4da4e5a5529c0601258a5b77f99956.exe

  • Size

    807KB

  • MD5

    e8d08b5cf95e2403bacb3cb73bf62c1c

  • SHA1

    3dbd3cecf1b0e339ac59925d8372f61ca2fdc778

  • SHA256

    1d1572e265b303768aebc2ad4531521a6f4da4e5a5529c0601258a5b77f99956

  • SHA512

    84c8c8379544f8a68bfc7a4c57cf4cee399b62984cef7a7bd9af44c8863923e3df3150bc831c865047a23424f75a1c94cdb03a183e45a1a6fbd51a3212065b05

  • SSDEEP

    12288:ky90F/9kBnpEbKsj1592wN5QGDLxXixyBeUMFj7SKT9NyT+kzen4R/HxA:kyg1kMJjN3AsHMFjGXTjK4x+

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d1572e265b303768aebc2ad4531521a6f4da4e5a5529c0601258a5b77f99956.exe
    "C:\Users\Admin\AppData\Local\Temp\1d1572e265b303768aebc2ad4531521a6f4da4e5a5529c0601258a5b77f99956.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinS3648.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinS3648.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimw1934.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimw1934.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4360
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it887130.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it887130.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1532
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr498414.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr498414.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinS3648.exe

    Filesize

    558KB

    MD5

    1384049fcb9086acf74d6be29a87630a

    SHA1

    fbc0575e73cd9c1959b537baa067b30b809ece70

    SHA256

    c5e021013add117eed2ff32da7ee1b105f84e8f7d851f0e45c28570141b4c1fe

    SHA512

    147fc911b3bae6168eb4d35d16bdc0b70f4892265048740f63ccd256156405a2797841fd08496e3e30bc46fb27299de0473dcb67d11aade2f1718df66dd2339e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimw1934.exe

    Filesize

    404KB

    MD5

    098c0a9f00e63c42e9e5649d54baefd7

    SHA1

    b6d5cbee7c337b34bad25205ae681467740c9b8b

    SHA256

    eed686917620b71dbf3ade9207fdf5415e4ea1cddc64a54c7cb1cf58fd839d5d

    SHA512

    a09c2abc33c5c283b5153f3039e097449409d2b8ffa0d3f49d4a9b827e476049cef81c23c3e3c55b8be7e462ddf48d9496dea5bd67fc0899b7fb74b8aedab51d

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it887130.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr498414.exe

    Filesize

    361KB

    MD5

    14655daca3ca6dc31c89179350ff3822

    SHA1

    b4bebdc0c509f3fbdde88c5ac51fa15c7a77068b

    SHA256

    458d52a79d2ff129e83d804bd41bc19eed751c46a6a27b3fa10c48ec37ed85ac

    SHA512

    ecf15d520f4ba2baf02acd2787a7457319e790b1b5c547fe48caa789036372018ec86c85ccfa82f0fcd52e0dbcc95a78c9064a968726eeb008f3695a1a05879c

  • memory/1532-21-0x00007FFFCCC93000-0x00007FFFCCC95000-memory.dmp

    Filesize

    8KB

  • memory/1532-22-0x00000000007E0000-0x00000000007EA000-memory.dmp

    Filesize

    40KB

  • memory/1532-23-0x00007FFFCCC93000-0x00007FFFCCC95000-memory.dmp

    Filesize

    8KB

  • memory/2056-71-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-61-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-31-0x00000000077F0000-0x000000000782A000-memory.dmp

    Filesize

    232KB

  • memory/2056-39-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-63-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-95-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-93-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-91-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-89-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-87-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-85-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-83-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-81-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-79-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-77-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-75-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-73-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-29-0x0000000004C90000-0x0000000004CCC000-memory.dmp

    Filesize

    240KB

  • memory/2056-69-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-67-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-65-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-30-0x0000000007200000-0x00000000077A4000-memory.dmp

    Filesize

    5.6MB

  • memory/2056-59-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-57-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-55-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-53-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-51-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-49-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-47-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-45-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-43-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-41-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-37-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-35-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-33-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-32-0x00000000077F0000-0x0000000007825000-memory.dmp

    Filesize

    212KB

  • memory/2056-824-0x0000000009CF0000-0x000000000A308000-memory.dmp

    Filesize

    6.1MB

  • memory/2056-825-0x000000000A350000-0x000000000A362000-memory.dmp

    Filesize

    72KB

  • memory/2056-826-0x000000000A370000-0x000000000A47A000-memory.dmp

    Filesize

    1.0MB

  • memory/2056-827-0x000000000A490000-0x000000000A4CC000-memory.dmp

    Filesize

    240KB

  • memory/2056-828-0x0000000006D30000-0x0000000006D7C000-memory.dmp

    Filesize

    304KB