Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2024 06:45

General

  • Target

    287c9660c07ac4675a47677458b15f818558daffa39761f0672a7da1ed5c1a65.exe

  • Size

    568KB

  • MD5

    9c7a6959f8895c9b1a23bb1b81a6f4a7

  • SHA1

    562f4c2035ba88fb4e0838f11a71ad459c744725

  • SHA256

    287c9660c07ac4675a47677458b15f818558daffa39761f0672a7da1ed5c1a65

  • SHA512

    12abe3a40eac564ecf78da56e1fc92e05bbe51da530f6e27aebb53520d9dabffdc500ec22eb1ae260d1f967a82e7128c7aee2cd0132340e57c11c9c37ec0f21b

  • SSDEEP

    12288:/y9098+PIfhtGltMHDbTPBT5t5eYIeioiek4LNARp0x:/yeUGltCXFVt5eYIFQnWRp0x

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\287c9660c07ac4675a47677458b15f818558daffa39761f0672a7da1ed5c1a65.exe
    "C:\Users\Admin\AppData\Local\Temp\287c9660c07ac4675a47677458b15f818558daffa39761f0672a7da1ed5c1a65.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNo7819.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNo7819.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it287319.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it287319.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1952
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr368764.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr368764.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNo7819.exe

    Filesize

    415KB

    MD5

    da62bc2b677c6f661b9d93b95f4ce67d

    SHA1

    2b78fe3adf16f42d9d539601c77bae4b195d081f

    SHA256

    41e810e3b4db8e833bf643304da7cd0b1d07bb36fd6e97282fb3c465e7b99ea8

    SHA512

    7348b043fe7f0af3e0442c021148ce5a07fc29c92ffa23efa5a169c9cd0cb95dacdc97245680f4ad09df64a33ab90bd0f1cfe7366b6219c76d7cf14cfd25e5cd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it287319.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr368764.exe

    Filesize

    360KB

    MD5

    e12dc270ace18045e5e10abf8a3ec2ba

    SHA1

    e86b928548fc4817c1b71a461035e2228673d248

    SHA256

    95ab6617929867dfb4c543de2d302559e032640efe277d741c7506ad65999f78

    SHA512

    54e5ff135ec224b04cc28e1fce662f2592a98cea809729f0e886b1d6f7b70562af4277518ec5fcf21ff4da1fc435718d37f2c8ae082654b8b966a9d544649e50

  • memory/928-74-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-22-0x0000000004A50000-0x0000000004A8C000-memory.dmp

    Filesize

    240KB

  • memory/928-25-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-70-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-23-0x0000000007550000-0x0000000007AF4000-memory.dmp

    Filesize

    5.6MB

  • memory/928-24-0x0000000004C10000-0x0000000004C4A000-memory.dmp

    Filesize

    232KB

  • memory/928-26-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-38-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-88-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-86-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-72-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-80-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-68-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-819-0x000000000A4A0000-0x000000000A5AA000-memory.dmp

    Filesize

    1.0MB

  • memory/928-821-0x0000000004950000-0x000000000499C000-memory.dmp

    Filesize

    304KB

  • memory/928-818-0x0000000004F90000-0x0000000004FA2000-memory.dmp

    Filesize

    72KB

  • memory/928-817-0x0000000009E80000-0x000000000A498000-memory.dmp

    Filesize

    6.1MB

  • memory/928-79-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-77-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-46-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-84-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-82-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-820-0x0000000004FC0000-0x0000000004FFC000-memory.dmp

    Filesize

    240KB

  • memory/928-66-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-64-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-62-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-60-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-58-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-56-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-54-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-52-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-50-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-48-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-44-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-42-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-40-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-36-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-34-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-32-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-30-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/928-28-0x0000000004C10000-0x0000000004C45000-memory.dmp

    Filesize

    212KB

  • memory/1952-16-0x00007FFD30F63000-0x00007FFD30F65000-memory.dmp

    Filesize

    8KB

  • memory/1952-14-0x00007FFD30F63000-0x00007FFD30F65000-memory.dmp

    Filesize

    8KB

  • memory/1952-15-0x0000000000890000-0x000000000089A000-memory.dmp

    Filesize

    40KB