Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 19:34

General

  • Target

    466299982a9984517043bb2d025e563c2e85f98d05e99d0bad225625105e7579.exe

  • Size

    746KB

  • MD5

    60fb08489bf0af085b1ad1e4eb09f600

  • SHA1

    f1d12c5ca5ceaccc361b332a61e7959fed239116

  • SHA256

    466299982a9984517043bb2d025e563c2e85f98d05e99d0bad225625105e7579

  • SHA512

    a33cc84622cdb2aeb4b7020e6d763d9866350469baf291e1de39f1953ba0ae2ab42346e2a63b58b50344d64a22e1f7b5ddc0d699f8495a97f66fea757c984f7f

  • SSDEEP

    12288:cy90cfXKcCVwvhD3f9S9uPvyDL4HtZhbEX7UUK5oroyYfpw1X/TUH:cyjfXF3fg9uPvYL4HNbcQ5nvxmG

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\466299982a9984517043bb2d025e563c2e85f98d05e99d0bad225625105e7579.exe
    "C:\Users\Admin\AppData\Local\Temp\466299982a9984517043bb2d025e563c2e85f98d05e99d0bad225625105e7579.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un890095.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un890095.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48345142.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48345142.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3708
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1104
          4⤵
          • Program crash
          PID:4072
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk046870.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk046870.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3708 -ip 3708
    1⤵
      PID:2360

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un890095.exe

            Filesize

            592KB

            MD5

            174328767e103069e94c2846ed891bc5

            SHA1

            d63bc1eed736f693f1643123add85c354baa1b14

            SHA256

            5de3dea40bef3b9d7e4f8a38b4735986f78bb420446a8904a363243fec09bc52

            SHA512

            c7f91004bae25468095e92288a9732ae77b7fe95044aa42daa63d98fe40f38f51abb1913877fdf0e50feddf221fe338726dd8c40d109905a4c34f79d639afe63

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\48345142.exe

            Filesize

            376KB

            MD5

            eb2e948c12422c76aa819e4a510b6beb

            SHA1

            54f83b8f8b288edaec9111197fd953f3835e9eae

            SHA256

            35196e27bc6b6f56f4660f32e9bd7e1e2f8c8d817d248cb5362b1607e194b77d

            SHA512

            59c5d5a7c8f68c8b92806ba48b67270e09e99ae6799b02126d951baddea6987446014146658cd1f39139cc3eac48436ccc9267aa63edb1c32044d7aeb6157f1a

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk046870.exe

            Filesize

            459KB

            MD5

            6110c2c21817e5b125f401fe5a7c6fc8

            SHA1

            e8cffad0449a25a3144795d9e00aa08134b09032

            SHA256

            9e9a5e87351593221923f9d5473ba679ac445e4d11d41dd84779c89d0ef2b880

            SHA512

            7ba26ec5296879c7f2f70495a2de1483b48d439fc2042ba93d6bbbae249c250a107beb2caf126885f598118e6a78a3b58131a49d23faef47342d545fdfe4db5d

          • memory/1380-83-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-854-0x0000000007900000-0x0000000007F18000-memory.dmp

            Filesize

            6.1MB

          • memory/1380-63-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-79-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-67-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-69-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-71-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-73-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-75-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-81-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-857-0x00000000080E0000-0x000000000811C000-memory.dmp

            Filesize

            240KB

          • memory/1380-858-0x0000000004730000-0x000000000477C000-memory.dmp

            Filesize

            304KB

          • memory/1380-85-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-62-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-856-0x0000000007FC0000-0x00000000080CA000-memory.dmp

            Filesize

            1.0MB

          • memory/1380-855-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

            Filesize

            72KB

          • memory/1380-87-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-89-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-91-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-93-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-95-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-77-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-65-0x0000000004D00000-0x0000000004D35000-memory.dmp

            Filesize

            212KB

          • memory/1380-61-0x0000000004D00000-0x0000000004D3A000-memory.dmp

            Filesize

            232KB

          • memory/1380-60-0x0000000004C00000-0x0000000004C3C000-memory.dmp

            Filesize

            240KB

          • memory/3708-43-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-55-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3708-54-0x0000000000400000-0x0000000000803000-memory.dmp

            Filesize

            4.0MB

          • memory/3708-51-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3708-50-0x0000000000950000-0x0000000000A50000-memory.dmp

            Filesize

            1024KB

          • memory/3708-29-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-23-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-25-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-27-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-31-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-33-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-35-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-37-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-39-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-41-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-47-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-22-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-49-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-45-0x0000000002950000-0x0000000002962000-memory.dmp

            Filesize

            72KB

          • memory/3708-21-0x0000000002950000-0x0000000002968000-memory.dmp

            Filesize

            96KB

          • memory/3708-20-0x0000000004F80000-0x0000000005524000-memory.dmp

            Filesize

            5.6MB

          • memory/3708-19-0x00000000023A0000-0x00000000023BA000-memory.dmp

            Filesize

            104KB

          • memory/3708-18-0x0000000000400000-0x0000000000803000-memory.dmp

            Filesize

            4.0MB

          • memory/3708-17-0x0000000000400000-0x0000000000803000-memory.dmp

            Filesize

            4.0MB

          • memory/3708-16-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/3708-15-0x0000000000950000-0x0000000000A50000-memory.dmp

            Filesize

            1024KB