Analysis

  • max time kernel
    113s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 08:47

General

  • Target

    1e92413f7cbc744b79291acd619f4124d4a74b15eedad4e1dfb29910e27e046cN.exe

  • Size

    550KB

  • MD5

    3ce4cd8174024e94d1d8758ba9c2e8e0

  • SHA1

    a1256c4bce41f864ca9b64173d7d3940d7d2a2c9

  • SHA256

    1e92413f7cbc744b79291acd619f4124d4a74b15eedad4e1dfb29910e27e046c

  • SHA512

    257f0d3e46bc070fc8a8541bf07a6f08b33f502738c8d63b9b8c014f1912a61c6f31274b9fe737ba68a41d18b61a44c7396f9bb0f3d31f91686a0ef339fe4187

  • SSDEEP

    12288:2y90TOSJ8bi0IRzkGnHY/U+0ebzm9gJfCSdn:2y6LEijLcU+7zm9gJfC0

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e92413f7cbc744b79291acd619f4124d4a74b15eedad4e1dfb29910e27e046cN.exe
    "C:\Users\Admin\AppData\Local\Temp\1e92413f7cbc744b79291acd619f4124d4a74b15eedad4e1dfb29910e27e046cN.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr150953.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr150953.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2632
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 1100
        3⤵
        • Program crash
        PID:4900
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu312211.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu312211.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1348
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2632 -ip 2632
    1⤵
      PID:4976

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pr150953.exe

            Filesize

            277KB

            MD5

            9efe15cd302bccb28fb1e7c8df71ade0

            SHA1

            cbc8b829caadf6ed02542def696d1c78c15dd8a7

            SHA256

            5e9da66df2c1a46f48577e76eaed661f997193474e92ecd8d42eebe73c02c350

            SHA512

            c5f3595aa3acd5c8af0575d7c8caae6449871522d8905d99af9772948a95c31cea1c696ca831626f5ad3ff4ca334b2e8ff404fa9dc260c343fddba71bc782c66

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qu312211.exe

            Filesize

            360KB

            MD5

            f54e0e0c1242afc2966d0dcd7709b7d0

            SHA1

            a6ad360b767901848bb6430d4540748f3103aa7a

            SHA256

            3aae91d0d367136e2b885f382abf1302b8739928d43c700c71952d923344f577

            SHA512

            2eb290d48e40adf1b996e9d294a7c0d4d8745916d96f4d4f4dae65ad435fd63f8894b09840a06835aa8bcfdb58f3fee691b20067a1c25ad8767470078015106a

          • memory/1348-67-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-87-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-849-0x000000000A340000-0x000000000A352000-memory.dmp

            Filesize

            72KB

          • memory/1348-848-0x0000000009CE0000-0x000000000A2F8000-memory.dmp

            Filesize

            6.1MB

          • memory/1348-56-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-57-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-59-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-61-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-63-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-65-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-851-0x000000000A480000-0x000000000A4BC000-memory.dmp

            Filesize

            240KB

          • memory/1348-852-0x0000000004AB0000-0x0000000004AFC000-memory.dmp

            Filesize

            304KB

          • memory/1348-850-0x000000000A360000-0x000000000A46A000-memory.dmp

            Filesize

            1.0MB

          • memory/1348-73-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-69-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-75-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-77-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-79-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-81-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-83-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-85-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-71-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-89-0x00000000077E0000-0x0000000007815000-memory.dmp

            Filesize

            212KB

          • memory/1348-55-0x00000000077E0000-0x000000000781A000-memory.dmp

            Filesize

            232KB

          • memory/1348-54-0x0000000004D10000-0x0000000004D4C000-memory.dmp

            Filesize

            240KB

          • memory/2632-33-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-48-0x0000000000400000-0x0000000002B9F000-memory.dmp

            Filesize

            39.6MB

          • memory/2632-49-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2632-47-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2632-45-0x0000000002C80000-0x0000000002CAD000-memory.dmp

            Filesize

            180KB

          • memory/2632-43-0x0000000002CB0000-0x0000000002DB0000-memory.dmp

            Filesize

            1024KB

          • memory/2632-17-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-19-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-21-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-14-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-15-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-25-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-27-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-29-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-32-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-36-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-37-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-39-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-42-0x0000000000400000-0x0000000002B9F000-memory.dmp

            Filesize

            39.6MB

          • memory/2632-41-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-23-0x0000000004D80000-0x0000000004D92000-memory.dmp

            Filesize

            72KB

          • memory/2632-13-0x0000000004D80000-0x0000000004D98000-memory.dmp

            Filesize

            96KB

          • memory/2632-12-0x0000000007480000-0x0000000007A24000-memory.dmp

            Filesize

            5.6MB

          • memory/2632-11-0x0000000004BF0000-0x0000000004C0A000-memory.dmp

            Filesize

            104KB

          • memory/2632-10-0x0000000000400000-0x0000000000430000-memory.dmp

            Filesize

            192KB

          • memory/2632-9-0x0000000002C80000-0x0000000002CAD000-memory.dmp

            Filesize

            180KB

          • memory/2632-8-0x0000000002CB0000-0x0000000002DB0000-memory.dmp

            Filesize

            1024KB