Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:02

General

  • Target

    dda2f7a4dc61593f572c743c4eecebfe3b5fb55ffea2844fb40372245f23e7be.exe

  • Size

    920KB

  • MD5

    dbce3f9c7d5e42a12eacda776b1a49e5

  • SHA1

    75e1b7da2fef79a56569ef71af1c3f9e2b9a04de

  • SHA256

    dda2f7a4dc61593f572c743c4eecebfe3b5fb55ffea2844fb40372245f23e7be

  • SHA512

    948436372d17c79a18d7c429d0ba7de7b2312a13dbeb0d48150f657543f1ac24058eb332c4dbb248eed56c81af618d6785bea3319c064801d41433e82c7fa8de

  • SSDEEP

    24576:5ykDT/+6YwM96hRS+T75xsa3KLcfrhelXFWsYqtuGx6FCGU:skHozEvLD7telXFzK

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dda2f7a4dc61593f572c743c4eecebfe3b5fb55ffea2844fb40372245f23e7be.exe
    "C:\Users\Admin\AppData\Local\Temp\dda2f7a4dc61593f572c743c4eecebfe3b5fb55ffea2844fb40372245f23e7be.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifJ9763.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifJ9763.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziCM3020.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziCM3020.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it670988.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it670988.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1560
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr843899.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr843899.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3276
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:3316

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifJ9763.exe

          Filesize

          616KB

          MD5

          3858354b8d04993efbc9908cf332adfe

          SHA1

          ff3922abcf6f16777720c9e050fb750430f91478

          SHA256

          aef7b199ad512e2e248ebb811785a7a6c274b9b7fb0a3e251217babe4d01ef1d

          SHA512

          0f6c8de17f83bf2692e88f0d5b2ab459970431b6554918b5c6ca752cdb6675a19c73eba49e098bf71680260fc8453ecc01d4c8cb196c88df5ac3637bd2791de0

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziCM3020.exe

          Filesize

          461KB

          MD5

          ee0825cdf5cfdb06e91ca522e2a75663

          SHA1

          1b1d4bc34e4b8219f482d53af0fe84a5b54f3bd2

          SHA256

          2767936a4c6a15d76b71c2e6305f96aec19fde99333bb8ee69415e7eb6346137

          SHA512

          a9e58569d774f8ca77f11e152f3fb4ee12fcd30a6b11a777237dffe34c1640059ace37d2b46bff3653d42e911dfa9beded19e707d49f4d6c457420310373965f

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it670988.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr843899.exe

          Filesize

          472KB

          MD5

          a78344177ef52664d674b99498c8717a

          SHA1

          c8bb120c471d5dbb47deda7e87f02c63e37698cc

          SHA256

          60e3dd1958800944a7e02b2c8f73260be3c20c0a52ce459f4d2a7e5c1953260f

          SHA512

          57a685c4f640786c390965e9162d9fc3bf5120d27fa9339805fcf209d67091bc44d2969e481b8ca37b600763be6797179f40a0bba4d700f30c79b91b6bf7bbfd

        • memory/1560-21-0x00007FF985673000-0x00007FF985675000-memory.dmp

          Filesize

          8KB

        • memory/1560-22-0x0000000000B20000-0x0000000000B2A000-memory.dmp

          Filesize

          40KB

        • memory/1560-23-0x00007FF985673000-0x00007FF985675000-memory.dmp

          Filesize

          8KB

        • memory/3276-95-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-85-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-31-0x00000000029A0000-0x00000000029DA000-memory.dmp

          Filesize

          232KB

        • memory/3276-41-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-47-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-45-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-43-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-93-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-71-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-65-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-53-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-39-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-37-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-35-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-33-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-32-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-51-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-29-0x00000000027C0000-0x00000000027FC000-memory.dmp

          Filesize

          240KB

        • memory/3276-91-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-89-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-87-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-30-0x0000000005020000-0x00000000055C4000-memory.dmp

          Filesize

          5.6MB

        • memory/3276-83-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-81-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-79-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-77-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-75-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-73-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-69-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-67-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-63-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-61-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-59-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-57-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-55-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-49-0x00000000029A0000-0x00000000029D5000-memory.dmp

          Filesize

          212KB

        • memory/3276-824-0x0000000007950000-0x0000000007F68000-memory.dmp

          Filesize

          6.1MB

        • memory/3276-825-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

          Filesize

          72KB

        • memory/3276-826-0x0000000007FC0000-0x00000000080CA000-memory.dmp

          Filesize

          1.0MB

        • memory/3276-827-0x00000000080E0000-0x000000000811C000-memory.dmp

          Filesize

          240KB

        • memory/3276-828-0x00000000025A0000-0x00000000025EC000-memory.dmp

          Filesize

          304KB