Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:01

General

  • Target

    f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe

  • Size

    746KB

  • MD5

    96a6c4b28d349a3b379f052bbb2d8c6f

  • SHA1

    23cc31f23de3db9855236c1dfe6bb33abb90c01e

  • SHA256

    f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9

  • SHA512

    6b742fdce7def85aba7efd2e0388d94b1e0563c88eb98db5cc615f57ae3a7baa29364b9441374588aecf8dc5e00e483f89f72a54b92f07bbfe3ab937f240db75

  • SSDEEP

    12288:ky90g1iePbG47mLI0cRcfaSzJEJNuN6Mt7xNTF9kFWhZob44wnN5mU32T9z:kygePC4icCySzUMtz9auKb4ZnNQd5z

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe
    "C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2388

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe

          Filesize

          592KB

          MD5

          98d6d63d33b7068bb82d7b467b8e8e9b

          SHA1

          ac7bf450d77157413aa185b198cbad7f55b709d0

          SHA256

          04eb1a69cb2ac63ce2e0d9a0e119b683f109e3b2d75aa59edb3ad03790d50f66

          SHA512

          9484c7680cfc8cd4dbe296864d42dbee9e564f5512388120eb84f6a41bb5acc2b73a49959dee02c7c3c3c4116052b187bf262c08fa7dc5189b7985c7fb2bd962

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe

          Filesize

          377KB

          MD5

          c9a968a7fd8c3153a04c79e05d53dc4e

          SHA1

          ca727a66c32b9c2bf95d52d2404179df122af2e1

          SHA256

          9d9bb0c8c3e93b35eb7d5b3ef47d663ba906e37ba372b366d976042b807ac31f

          SHA512

          36204dbc4d5429402d92ec10defb72ad7c59ef87a3dd1a720e743b7d46582cd6f555b4003927068228d50822ac205fa60f900c087e240184a9de2a84d3958d04

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe

          Filesize

          459KB

          MD5

          e79e5f1f45bd4f426b0884c66131314e

          SHA1

          419ee6311eb558eb44923e82dfbcefcbfc4ea1f0

          SHA256

          157f165ab8fe9936f6c6ad9d54c6b3a436976f1a0ca12baf108f9c82f8f0af6e

          SHA512

          3a765a5939d1f38751b9b7221522824d3b5461182a3c5e3e1b10389e2b31cd306e7d72a83a2d2b8693ea8047a9148c17f490b8521e7d0378cf34679f94117008

        • memory/1064-15-0x0000000000990000-0x0000000000A90000-memory.dmp

          Filesize

          1024KB

        • memory/1064-16-0x00000000008E0000-0x000000000090D000-memory.dmp

          Filesize

          180KB

        • memory/1064-17-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/1064-18-0x0000000000400000-0x0000000000803000-memory.dmp

          Filesize

          4.0MB

        • memory/1064-19-0x00000000027D0000-0x00000000027EA000-memory.dmp

          Filesize

          104KB

        • memory/1064-20-0x0000000004E70000-0x0000000005414000-memory.dmp

          Filesize

          5.6MB

        • memory/1064-21-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

          Filesize

          96KB

        • memory/1064-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-47-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-40-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-27-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-25-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-23-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-22-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

          Filesize

          72KB

        • memory/1064-50-0x0000000000990000-0x0000000000A90000-memory.dmp

          Filesize

          1024KB

        • memory/1064-51-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/1064-55-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/1064-54-0x0000000000400000-0x0000000000803000-memory.dmp

          Filesize

          4.0MB

        • memory/2388-60-0x0000000002910000-0x000000000294C000-memory.dmp

          Filesize

          240KB

        • memory/2388-61-0x00000000053F0000-0x000000000542A000-memory.dmp

          Filesize

          232KB

        • memory/2388-71-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-69-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-67-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-65-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-63-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-62-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-89-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-95-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-93-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-92-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-87-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-85-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-83-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-81-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-79-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-77-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-75-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-73-0x00000000053F0000-0x0000000005425000-memory.dmp

          Filesize

          212KB

        • memory/2388-854-0x00000000078F0000-0x0000000007F08000-memory.dmp

          Filesize

          6.1MB

        • memory/2388-855-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/2388-856-0x0000000007FC0000-0x00000000080CA000-memory.dmp

          Filesize

          1.0MB

        • memory/2388-857-0x00000000080E0000-0x000000000811C000-memory.dmp

          Filesize

          240KB

        • memory/2388-858-0x00000000023C0000-0x000000000240C000-memory.dmp

          Filesize

          304KB