Analysis

  • max time kernel
    114s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 20:37

General

  • Target

    e2d5ffe18f3551e3b69d056918bc8b4ad29eac1788cdb70c93acf1f923938dee.exe

  • Size

    540KB

  • MD5

    48c6620de79cd851cc393bde8899d6ce

  • SHA1

    ef6484bf3de20010b48715a4a0e463120cee671d

  • SHA256

    e2d5ffe18f3551e3b69d056918bc8b4ad29eac1788cdb70c93acf1f923938dee

  • SHA512

    c2539e4e91dc4cc90cf9d1da8e57ec25e318f74b7e9b35fcbd69d55368b7461a57543c1bf7d29fe8681a7a9a38f9931212880ebf452e0f29e771a3f71cd1aaca

  • SSDEEP

    12288:dy9073jPpoeWbgJWx83Wl/gS0vqqTPT7DjWazx8Bne97:dyK7poeWbDKWl/QjvRqRe97

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2d5ffe18f3551e3b69d056918bc8b4ad29eac1788cdb70c93acf1f923938dee.exe
    "C:\Users\Admin\AppData\Local\Temp\e2d5ffe18f3551e3b69d056918bc8b4ad29eac1788cdb70c93acf1f923938dee.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3832
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr058155.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr058155.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 1084
        3⤵
        • Program crash
        PID:1092
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu846709.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu846709.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4652
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2848 -ip 2848
    1⤵
      PID:2684

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr058155.exe

            Filesize

            278KB

            MD5

            42acb4365780d3c9ea5f4c4a8977d3c2

            SHA1

            7cc4f87a898700078fc11a39b28486a05f85cc76

            SHA256

            530b99d6f66bacf24d468e56d5c208252478fde3d46a2acd8d2c1fca8a5d9d63

            SHA512

            b93e75b74321cbf0312886d8120e910b7f7d0d333f34c47d1d6de082a79c50dbafad9a3008dfcca976cc41f21d7ab3d310de7baefffcb4784efe6ba6ceecf4cb

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu846709.exe

            Filesize

            361KB

            MD5

            297bcb8660bb24171025d73ae9e9b30b

            SHA1

            32f2c0e718a465a21097535172dbcc4d5af6383f

            SHA256

            62305f3ff5ec34b2077ec23d14253a89de49a8e3a21acf1b5a2e79c9f25c08d6

            SHA512

            17862e21fb7a72c914f12778745a527fb8301edff63cef878f78e3b8b8c79e386d424ed79937a059d2ed70d9578fe6c28b36b6f2b7f218aaec7146317479cb8b

          • memory/2848-8-0x0000000002F80000-0x0000000003080000-memory.dmp

            Filesize

            1024KB

          • memory/2848-9-0x0000000002C80000-0x0000000002CAD000-memory.dmp

            Filesize

            180KB

          • memory/2848-10-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2848-11-0x0000000004BD0000-0x0000000004BEA000-memory.dmp

            Filesize

            104KB

          • memory/2848-12-0x00000000071A0000-0x0000000007744000-memory.dmp

            Filesize

            5.6MB

          • memory/2848-13-0x0000000007150000-0x0000000007168000-memory.dmp

            Filesize

            96KB

          • memory/2848-14-0x0000000000400000-0x0000000002BA6000-memory.dmp

            Filesize

            39.6MB

          • memory/2848-42-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-40-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-38-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-36-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-34-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-32-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-30-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-28-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-26-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-24-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-22-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-20-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-18-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-16-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-15-0x0000000007150000-0x0000000007162000-memory.dmp

            Filesize

            72KB

          • memory/2848-43-0x0000000002F80000-0x0000000003080000-memory.dmp

            Filesize

            1024KB

          • memory/2848-45-0x0000000002C80000-0x0000000002CAD000-memory.dmp

            Filesize

            180KB

          • memory/2848-46-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2848-49-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2848-50-0x0000000000400000-0x0000000002BA6000-memory.dmp

            Filesize

            39.6MB

          • memory/4652-55-0x00000000049E0000-0x0000000004A1C000-memory.dmp

            Filesize

            240KB

          • memory/4652-56-0x0000000004C30000-0x0000000004C6A000-memory.dmp

            Filesize

            232KB

          • memory/4652-60-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-58-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-57-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-76-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-90-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-88-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-86-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-82-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-80-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-79-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-74-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-72-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-70-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-68-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-66-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-64-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-62-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-84-0x0000000004C30000-0x0000000004C65000-memory.dmp

            Filesize

            212KB

          • memory/4652-849-0x0000000009D30000-0x000000000A348000-memory.dmp

            Filesize

            6.1MB

          • memory/4652-850-0x000000000A350000-0x000000000A362000-memory.dmp

            Filesize

            72KB

          • memory/4652-851-0x000000000A370000-0x000000000A47A000-memory.dmp

            Filesize

            1.0MB

          • memory/4652-852-0x000000000A490000-0x000000000A4CC000-memory.dmp

            Filesize

            240KB

          • memory/4652-853-0x0000000004A50000-0x0000000004A9C000-memory.dmp

            Filesize

            304KB