Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:00

General

  • Target

    d2b350d0cf8c4f65b6093d5d19aca8435e63cd50f5cf7b20c100649e911df75f.exe

  • Size

    560KB

  • MD5

    5fb89d7159e987a3010578a88187323f

  • SHA1

    dc9cd41aa41c3689543c3a045c490b3bd83f6d35

  • SHA256

    d2b350d0cf8c4f65b6093d5d19aca8435e63cd50f5cf7b20c100649e911df75f

  • SHA512

    273397f37576a35d9859faa2a4b0196cba0fce2be376f9d2a9ab81ebce0c73639cd1374342b643b11b3df8accb4164492f4e55450df85c1326d00ee1cbc34861

  • SSDEEP

    12288:oy90Z4FbxQ8qom654mii73ZphBMfFTN1BQudVJdegG6RA3st32:oy84vhDDx0bywjR3t32

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2b350d0cf8c4f65b6093d5d19aca8435e63cd50f5cf7b20c100649e911df75f.exe
    "C:\Users\Admin\AppData\Local\Temp\d2b350d0cf8c4f65b6093d5d19aca8435e63cd50f5cf7b20c100649e911df75f.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihd8670.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihd8670.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it030887.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it030887.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4688
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp335528.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp335528.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3244

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zihd8670.exe

          Filesize

          406KB

          MD5

          889e683d7ca01568d7e1005e34bc06da

          SHA1

          804dfde8bde203784ed144ee670b182397eeb118

          SHA256

          20bf5ceee8fc30b9aa85fca972df46653d811d4ffe631c0453c230b0ce299715

          SHA512

          230e088c5d85bb331b6f087b550b086d16e34ed931f249f231244717cbb974aa6078f5caa91baf6b95def622dab64f95ffa441bd09031cf0ace1b25912b57c59

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it030887.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp335528.exe

          Filesize

          353KB

          MD5

          219486253532aae804efbac57c1ac96a

          SHA1

          cfa46bd089868231910be5e66c16cd62a2babd35

          SHA256

          5574a17abfe8668a558bbe0cc89db85d55a03f888777a3cb0b0490ceb734ed9a

          SHA512

          25ff07e927476a125726ddc87dea1e9b35d158a1946a1071cc78ba7db3ac139a61a1109e76e4139b8f3307272b963b7a33bcde3bb9d769be05cec7337b154a55

        • memory/3244-62-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-36-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-821-0x0000000004BF0000-0x0000000004C3C000-memory.dmp

          Filesize

          304KB

        • memory/3244-22-0x0000000004E00000-0x0000000004E3C000-memory.dmp

          Filesize

          240KB

        • memory/3244-23-0x00000000073B0000-0x0000000007954000-memory.dmp

          Filesize

          5.6MB

        • memory/3244-24-0x00000000072E0000-0x000000000731A000-memory.dmp

          Filesize

          232KB

        • memory/3244-40-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-88-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-86-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-84-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-80-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-78-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-76-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-74-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-72-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-70-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-68-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-66-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-64-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-820-0x000000000A5D0000-0x000000000A60C000-memory.dmp

          Filesize

          240KB

        • memory/3244-56-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-819-0x000000000A4B0000-0x000000000A5BA000-memory.dmp

          Filesize

          1.0MB

        • memory/3244-58-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-54-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-52-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-50-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-48-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-46-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-44-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-42-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-38-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-60-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-34-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-32-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-30-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-82-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-28-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-26-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-25-0x00000000072E0000-0x0000000007315000-memory.dmp

          Filesize

          212KB

        • memory/3244-817-0x0000000009DE0000-0x000000000A3F8000-memory.dmp

          Filesize

          6.1MB

        • memory/3244-818-0x000000000A490000-0x000000000A4A2000-memory.dmp

          Filesize

          72KB

        • memory/4688-16-0x00007FFA47E03000-0x00007FFA47E05000-memory.dmp

          Filesize

          8KB

        • memory/4688-14-0x00007FFA47E03000-0x00007FFA47E05000-memory.dmp

          Filesize

          8KB

        • memory/4688-15-0x0000000000030000-0x000000000003A000-memory.dmp

          Filesize

          40KB