Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 20:03

General

  • Target

    549c7219401a8d262589b2dd8fe3f2eaf367b02130b35abbb8501e2dfd38e61e.exe

  • Size

    406KB

  • MD5

    d37915b171af200777f300389ba36ec0

  • SHA1

    9c42cb7cd79181df8d2183305a303091c659df26

  • SHA256

    549c7219401a8d262589b2dd8fe3f2eaf367b02130b35abbb8501e2dfd38e61e

  • SHA512

    37282dafa4fd59389289f59cb09a726950ccab4c9237d605f85318e1bdf1eb2c9bbc119d133086fee7d409ec9b5dd1842b0c797285bba7818aed0798248e5846

  • SSDEEP

    12288:Jy90KR/1YZrEq/v9zA+phU+vFTn1B0udVJI1:JyX/12rEqKWXRil1

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\549c7219401a8d262589b2dd8fe3f2eaf367b02130b35abbb8501e2dfd38e61e.exe
    "C:\Users\Admin\AppData\Local\Temp\549c7219401a8d262589b2dd8fe3f2eaf367b02130b35abbb8501e2dfd38e61e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\it243219.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\it243219.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4808
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kp035151.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kp035151.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2200

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\it243219.exe

          Filesize

          11KB

          MD5

          7e93bacbbc33e6652e147e7fe07572a0

          SHA1

          421a7167da01c8da4dc4d5234ca3dd84e319e762

          SHA256

          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

          SHA512

          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kp035151.exe

          Filesize

          353KB

          MD5

          fae82e1b10244e510ed1e1b6c62780bc

          SHA1

          60acce5fcbc455a9be8e8918f3a3c846562b2280

          SHA256

          6c62fb75df138a164c86e2edc92c866984d202fdc660a452e0eec900164927b2

          SHA512

          0a09df36458295c1cebe3dea79f721664da0ecad1e4c613b77dddadeb75abf4c430cb704e6e6b1dda73960ee9187ddc823f70b2ad2d53e738bbfea002c42a5a8

        • memory/2200-15-0x0000000002ED0000-0x0000000002FD0000-memory.dmp

          Filesize

          1024KB

        • memory/2200-17-0x0000000000400000-0x0000000000449000-memory.dmp

          Filesize

          292KB

        • memory/2200-16-0x0000000002CA0000-0x0000000002CE6000-memory.dmp

          Filesize

          280KB

        • memory/2200-18-0x00000000071C0000-0x00000000071FC000-memory.dmp

          Filesize

          240KB

        • memory/2200-19-0x0000000007200000-0x00000000077A4000-memory.dmp

          Filesize

          5.6MB

        • memory/2200-20-0x00000000077F0000-0x000000000782A000-memory.dmp

          Filesize

          232KB

        • memory/2200-24-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-28-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-26-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-85-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-82-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-81-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-78-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-76-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-74-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-72-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-70-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-68-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-66-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-64-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-62-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-60-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-59-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-56-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-55-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-52-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-51-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-48-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-46-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-44-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-42-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-40-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-38-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-36-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-35-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-32-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-30-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-22-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-21-0x00000000077F0000-0x0000000007825000-memory.dmp

          Filesize

          212KB

        • memory/2200-813-0x0000000009CF0000-0x000000000A308000-memory.dmp

          Filesize

          6.1MB

        • memory/2200-814-0x000000000A350000-0x000000000A362000-memory.dmp

          Filesize

          72KB

        • memory/2200-815-0x000000000A370000-0x000000000A47A000-memory.dmp

          Filesize

          1.0MB

        • memory/2200-816-0x000000000A490000-0x000000000A4CC000-memory.dmp

          Filesize

          240KB

        • memory/2200-817-0x0000000004C70000-0x0000000004CBC000-memory.dmp

          Filesize

          304KB

        • memory/2200-818-0x0000000002ED0000-0x0000000002FD0000-memory.dmp

          Filesize

          1024KB

        • memory/2200-820-0x0000000000400000-0x0000000000449000-memory.dmp

          Filesize

          292KB

        • memory/4808-7-0x00007FFD0B4A3000-0x00007FFD0B4A5000-memory.dmp

          Filesize

          8KB

        • memory/4808-8-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

          Filesize

          40KB

        • memory/4808-9-0x00007FFD0B4A3000-0x00007FFD0B4A5000-memory.dmp

          Filesize

          8KB