Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
12/09/2026, 19:16
General
- Target f398b3fe08f6736060679513f0f623afff9975f71440dc9e1b02ba80e9f29ea3.exe
- Size 307KB
- Sample260912-xy85vavyds
- SHA256 f398b3fe08f6736060679513f0f623afff9975f71440dc9e1b02ba80e9f29ea3
Malware Config
Extracted
-
redline
-
diwer
-
217.196.96.101:4132
-
auth_value
42abfa9e4f2e290c8bdbc776fd9bb6ad
Signatures
- Family: Healer
Healer an antivirus disabler dropper.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Detects Healer an antivirus disabler dropper 18 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Modifies Windows Defender notification settings 3 TTPs 2 IoCs
- RedLine payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f398b3fe08f6736060679513f0f623afff9975f71440dc9e1b02ba80e9f29ea3.exe"C:\Users\Admin\AppData\Local\Temp\f398b3fe08f6736060679513f0f623afff9975f71440dc9e1b02ba80e9f29ea3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k4100036.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k4100036.exe2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Modifies Windows Defender notification settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l0971099.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l0971099.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Replay Monitor
Loading Replay Monitor...
Downloads
k4100036.exe
l0971099.exe
memory/3000-22-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-18-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-10-0x00000000022F0000-0x0000000002300000-memory.dmp
memory/3000-11-0x0000000004940000-0x0000000004EE4000-memory.dmp
memory/3000-12-0x0000000004F30000-0x0000000004F48000-memory.dmp
memory/3000-39-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-36-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-40-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-34-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-32-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-31-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-28-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-26-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-24-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-9-0x00000000022F0000-0x0000000002300000-memory.dmp
memory/3000-8-0x00000000022C0000-0x00000000022DA000-memory.dmp
memory/3000-14-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-16-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-20-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-13-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3000-41-0x00000000022F0000-0x0000000002300000-memory.dmp
memory/3000-7-0x00000000022F0000-0x0000000002300000-memory.dmp
memory/4648-46-0x0000000000CC0000-0x0000000000CF0000-memory.dmp
memory/4648-47-0x0000000001590000-0x0000000001596000-memory.dmp
memory/4648-48-0x000000000B0A0000-0x000000000B6B8000-memory.dmp
memory/4648-49-0x000000000AB90000-0x000000000AC9A000-memory.dmp
memory/4648-50-0x00000000055F0000-0x0000000005600000-memory.dmp
memory/4648-51-0x00000000055C0000-0x00000000055D2000-memory.dmp
memory/4648-52-0x000000000AAC0000-0x000000000AAFC000-memory.dmp
memory/4648-53-0x0000000001510000-0x000000000155C000-memory.dmp
memory/4648-54-0x00000000055F0000-0x0000000005600000-memory.dmp