Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 05:59

General

  • Target

    7fadae3dc0d19a434db4fb5bd8af5e3f560483dd8112ba01c9267d392ceea13d.exe

  • Size

    1.2MB

  • MD5

    796c81f568692f0383158a64a0f970a3

  • SHA1

    80e6ae31e12c53dfbd09f6666246a1c4691bf952

  • SHA256

    7fadae3dc0d19a434db4fb5bd8af5e3f560483dd8112ba01c9267d392ceea13d

  • SHA512

    5661d57d220cc8a4f4fc979d98813fe8128290f4ea180d4756f4938d2ac453093b43797704bf22070267aae9ec5e5fcf6cc73a0b833c9b8e6bf4e460ffe2771a

  • SSDEEP

    24576:uyUKQPCNm87LWOLfqcbfLcrbknTIKKfDAbRNjVsRE/lTgXkUfRMhsJBzc:9hYCV+OTbzcrbyyaR0RE/1gBfRysj

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fadae3dc0d19a434db4fb5bd8af5e3f560483dd8112ba01c9267d392ceea13d.exe
    "C:\Users\Admin\AppData\Local\Temp\7fadae3dc0d19a434db4fb5bd8af5e3f560483dd8112ba01c9267d392ceea13d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki847988.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki847988.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki777517.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki777517.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki252464.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki252464.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3376
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az334204.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az334204.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1464
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu030710.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu030710.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4012

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki847988.exe

          Filesize

          1.1MB

          MD5

          140d26beeaa35e36ad8c315fb4bcfdae

          SHA1

          404bebd1f7f1d4b039df0604f0d810bdb09aa9f1

          SHA256

          72243469be7dcc54e7c278f65f2e7a4e5ea4291d309d28be16d82b5ea43ea0bb

          SHA512

          893702ac709a9b2f0e1517990015f367ca22b5b5129f7088f621c269dccaa5e42dd5a64f5900735c1d8f34c04b486681c0e359f15700d04b3fe49c1cfaa93548

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki777517.exe

          Filesize

          788KB

          MD5

          b1d3310e5d5e6c741308038013820ec6

          SHA1

          1d7081bf5763408d7727247a51018fbdbb27e014

          SHA256

          86bd16e8bbca54c83a70240648764e56f672c042a7dd1ed3ed35a5b10b0454dd

          SHA512

          fa53624d9f99dd4c2a432a317b3da45bca2f9934615826ae5185f930f230d2d0c4641552d8a9266d14ec1a9163ccdb1f8ea2d76b2d508f5f54016366e8262cd2

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki252464.exe

          Filesize

          461KB

          MD5

          0651a7e5d4d48bd8f1442437c4ecbce9

          SHA1

          56b95f6fad8d88d8e67d7065d3dab719056e4241

          SHA256

          46642e2e1d30bb89ea784c009140961f6c100c975dc504a624e0f522e6aa9cda

          SHA512

          abb773b4a04383241684472914e69df982fb6b24799b83428a2163cbcd3f8a1ac7d8dd5ce47c4ea9ecb7bf543090f9e72513a94fad323fcbaa8ded87a78a09ed

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az334204.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu030710.exe

          Filesize

          472KB

          MD5

          46ffb1d03353f516da7a90e8221a7e05

          SHA1

          a8fac96a2dfc66eca7001776aa46fe7f60564ddc

          SHA256

          23df6815f315b5a2790e4d88257d003ceb04c9674a512e81de11d50142e95d88

          SHA512

          5574685bd174b9d7c4b4c6df7f49699897ce153d49f920807950d4e54ab3c9a748e83575285b93acad5eee21510420115484ac9351cdc863ec8e412caed9f07a

        • memory/1464-28-0x0000000000850000-0x000000000085A000-memory.dmp

          Filesize

          40KB

        • memory/4012-96-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-832-0x0000000005070000-0x00000000050AC000-memory.dmp

          Filesize

          240KB

        • memory/4012-36-0x0000000002AE0000-0x0000000002B1A000-memory.dmp

          Filesize

          232KB

        • memory/4012-52-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-50-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-48-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-46-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-44-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-92-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-72-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-42-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-40-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-38-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-37-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-100-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-98-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-34-0x0000000002790000-0x00000000027CC000-memory.dmp

          Filesize

          240KB

        • memory/4012-94-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-90-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-830-0x0000000005040000-0x0000000005052000-memory.dmp

          Filesize

          72KB

        • memory/4012-831-0x0000000008010000-0x000000000811A000-memory.dmp

          Filesize

          1.0MB

        • memory/4012-35-0x00000000050C0000-0x0000000005664000-memory.dmp

          Filesize

          5.6MB

        • memory/4012-829-0x00000000079F0000-0x0000000008008000-memory.dmp

          Filesize

          6.1MB

        • memory/4012-88-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-86-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-84-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-82-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-80-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-833-0x00000000025A0000-0x00000000025EC000-memory.dmp

          Filesize

          304KB

        • memory/4012-78-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-76-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-74-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-70-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-68-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-66-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-64-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-62-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-60-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-58-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-56-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB

        • memory/4012-54-0x0000000002AE0000-0x0000000002B15000-memory.dmp

          Filesize

          212KB