Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 13:35

General

  • Target

    0bf2273fe4b3d881f9b18e77bbef59723ee865c84b632b944b34d6e21462d77bN.exe

  • Size

    591KB

  • MD5

    2426dc70d9765f7d3cb5ad48fbc2c2b0

  • SHA1

    b312fcf8abcfb324ed3421cc1cc4e572016736d0

  • SHA256

    0bf2273fe4b3d881f9b18e77bbef59723ee865c84b632b944b34d6e21462d77b

  • SHA512

    35e2702b0999a674d638a7be81720513679e069dc8c2a73b42daefd02e88e6f60fbe8cccac28729bddc0ebf1a9f65267b458ec9a55550764d7da073c1e415024

  • SSDEEP

    12288:qy90cxFmNuyt6UGrsBATG7OZX3NVXfS6HnshDQ:qyXDwu8bMsCTG7uNVXf/

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bf2273fe4b3d881f9b18e77bbef59723ee865c84b632b944b34d6e21462d77bN.exe
    "C:\Users\Admin\AppData\Local\Temp\0bf2273fe4b3d881f9b18e77bbef59723ee865c84b632b944b34d6e21462d77bN.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\38463914.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\38463914.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 1088
        3⤵
        • Program crash
        PID:3168
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk941139.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk941139.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1044
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 536 -ip 536
    1⤵
      PID:4332

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\38463914.exe

      Filesize

      376KB

      MD5

      426dc5cf8b67df386d05b0667ce241f0

      SHA1

      5f09f0e64e7ad1600363d3fa36a3325f2e477d3f

      SHA256

      21ebe05f2466efb1dc85654d0f99e95cdbf2c0e4dc5acad1cacc3d898da1fc72

      SHA512

      fa7146c374f44639be60e2b9eded41f914f049fb63643756d3afc08185955e1bb47f4dd7900dac972c2f059d20f4a5a8dadb85a3f53db109cedd9f136edd87fc

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rk941139.exe

      Filesize

      459KB

      MD5

      94d93fdbb31954268f0bf3c3ad959b35

      SHA1

      d20336642b935a1412b38d725241e4ff1e8fa810

      SHA256

      7e54c68fdc404bc511812487b683e2ae4364c72a6cbfc5c837a2244194e4bfd6

      SHA512

      8d0d1b8d2f1b27b353508d144c05374c4b0834e4d802c04ddacb9fdb26bac79044c8f627b45cf0dd9dc3c7035f2f13b32e724dd343358f1aacf9ad21df4959a5

    • memory/536-48-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/536-10-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/536-8-0x0000000000810000-0x0000000000910000-memory.dmp

      Filesize

      1024KB

    • memory/536-12-0x00000000024C0000-0x00000000024DA000-memory.dmp

      Filesize

      104KB

    • memory/536-13-0x0000000005000000-0x00000000055A4000-memory.dmp

      Filesize

      5.6MB

    • memory/536-14-0x0000000002A50000-0x0000000002A68000-memory.dmp

      Filesize

      96KB

    • memory/536-42-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-40-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-38-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-36-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-34-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-32-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-30-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-28-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-26-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-24-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-22-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-20-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-18-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-16-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-15-0x0000000002A50000-0x0000000002A62000-memory.dmp

      Filesize

      72KB

    • memory/536-43-0x0000000000810000-0x0000000000910000-memory.dmp

      Filesize

      1024KB

    • memory/536-44-0x0000000000A00000-0x0000000000A2D000-memory.dmp

      Filesize

      180KB

    • memory/536-45-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/536-49-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/536-9-0x0000000000A00000-0x0000000000A2D000-memory.dmp

      Filesize

      180KB

    • memory/536-11-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/1044-850-0x0000000007930000-0x0000000007F48000-memory.dmp

      Filesize

      6.1MB

    • memory/1044-65-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-54-0x0000000000400000-0x0000000000817000-memory.dmp

      Filesize

      4.1MB

    • memory/1044-55-0x0000000002810000-0x000000000284C000-memory.dmp

      Filesize

      240KB

    • memory/1044-91-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-89-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-87-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-85-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-83-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-81-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-79-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-77-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-75-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-73-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-71-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-69-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-67-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-56-0x0000000000400000-0x0000000000817000-memory.dmp

      Filesize

      4.1MB

    • memory/1044-63-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-61-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-59-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-58-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/1044-57-0x0000000004E30000-0x0000000004E6A000-memory.dmp

      Filesize

      232KB

    • memory/1044-851-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

      Filesize

      72KB

    • memory/1044-852-0x0000000007FC0000-0x00000000080CA000-memory.dmp

      Filesize

      1.0MB

    • memory/1044-853-0x00000000080E0000-0x000000000811C000-memory.dmp

      Filesize

      240KB

    • memory/1044-854-0x00000000028A0000-0x00000000028EC000-memory.dmp

      Filesize

      304KB