Analysis

  • max time kernel
    131s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 14:40

General

  • Target

    2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe

  • Size

    1.0MB

  • MD5

    aa56dc80d4e82ae017ce150cf8fa48cc

  • SHA1

    2a7ee36a1296e0438ef0e7a9ab41d8ff03496ec4

  • SHA256

    2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad

  • SHA512

    ce4c8441785c866d0bc9ab8a5c23bba8815fd8a1e30b9ab10ec6a36c6aaba2ebf70bf3c53a9515a52402014daf6e2b25542397fc498bb9a12ad11ee602769daf

  • SSDEEP

    24576:XyaHBh7s7f2+6EFDn3Q521V2AJ56SANT0kAZJzgc:iahwfsEd3F1sAJ565gke

Malware Config

Extracted

Family

redline

Botnet

masha

C2

77.91.68.48:19071

Attributes
  • auth_value

    55b9b39a0dae383196a4b8d79e5bb805

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe
    "C:\Users\Admin\AppData\Local\Temp\2a4e0bfefe7b6b2a94d46c408fe05d1682392c66666138b8b0c32e028bf15aad.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3096
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:64
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4836
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3364
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe
          4⤵
          • Executes dropped EXE
          PID:4948

Network

  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    77.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.190.18.2.in-addr.arpa
    IN PTR
    Response
    77.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    23.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 476246
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: C019F77A119E44EAA3253F3DB9D809CD Ref B: LON04EDGE0708 Ref C: 2024-05-10T14:43:07Z
    date: Fri, 10 May 2024 14:43:07 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 499516
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9FD4AEF1310F4FDD910EA14D4F17FFAA Ref B: LON04EDGE0708 Ref C: 2024-05-10T14:43:07Z
    date: Fri, 10 May 2024 14:43:07 GMT
  • flag-be
    GET
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    88.221.83.184:443
    Request
    GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1107
    date: Fri, 10 May 2024 14:43:07 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.b453dd58.1715352187.3e37b4c
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    184.83.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    184.83.221.88.in-addr.arpa
    IN PTR
    Response
    184.83.221.88.in-addr.arpa
    IN PTR
    a88-221-83-184deploystaticakamaitechnologiescom
  • 77.91.68.48:19071
    c2096168.exe
    260 B
    5
  • 77.91.68.48:19071
    c2096168.exe
    260 B
    5
  • 77.91.68.48:19071
    c2096168.exe
    260 B
    5
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    34.9kB
    1.0MB
    741
    736

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    8.1kB
    16
    14
  • 88.221.83.184:443
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.4kB
    6.3kB
    16
    11

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 77.91.68.48:19071
    c2096168.exe
    260 B
    5
  • 77.91.68.48:19071
    c2096168.exe
    260 B
    5
  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    77.190.18.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    77.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    23.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    23.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
    173 B
    1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
    106 B
    1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    184.83.221.88.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    184.83.221.88.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6836019.exe

    Filesize

    908KB

    MD5

    25658f17325696a77fdc5dc5af300472

    SHA1

    0facd580ea7466701baf25ab3cd36945aea28b7d

    SHA256

    3c9d37c487d37aefab6c520534b2a76ee97ccb9d8dddc16b2220e3455f14344a

    SHA512

    1155d0d8b34cead480920efdc9220af31e82de4b7e843862163815d061da11e9457d34f16b2f55213728ef43f921ec0f363443fd4a8fe3488fea7612ae297c98

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6690351.exe

    Filesize

    725KB

    MD5

    a2e96ecf6ba60ff964a2b0b60dde7e27

    SHA1

    501080ad7058cac17e373c9acbda786c3ff9bdac

    SHA256

    0e712b394b21d5676bde7625b698470e0f7011ae4897abdec1a4f89dfa8cf096

    SHA512

    93c3963b8488abb826601dc90e98733b1e29549494039df1cd1fb2c351f2374a24ea2e2d8c66eefa51d6ee6a1b0221432a42cfa00eac510da0aef33ed4544bf1

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c2096168.exe

    Filesize

    492KB

    MD5

    d672c9ba43fa4ec7905376f48d1f5cbc

    SHA1

    e0c94e851acb35383c031780e03ea0861acf6dc8

    SHA256

    963945d65b9fa323b0825b650842d944de7c0d5ecbe7af4fe91097f1f6e42702

    SHA512

    551cd7811814302685a698d8a6d73e8ac2dbea66bac651bb2fc6457300d536529619bcb4973b072cedd88c08e96fae0f50abf39ca35e9bc09e38f48566c6bd53

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v8762757.exe

    Filesize

    326KB

    MD5

    d5b0ccf141e399d25360a28d534df7f0

    SHA1

    ef15c7a65069cb727ffdb2232c6210d030b4fbfe

    SHA256

    0170edb4d68699bbc4babbafeada5ed5138206b0d06d736a1340a077256b3d30

    SHA512

    0ebdf9f7ff7adaa314abec6e2359d2e241c483be42b81aadc097dac13c70a5906ee6e4345579dece05a84373f47462f5f53aee6554e3a4abaf142a5a09c00e51

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a2081936.exe

    Filesize

    294KB

    MD5

    bdb5076d6b84394534265c87b725acd6

    SHA1

    be2336c83ca619167ef129bd699027e21fa187b1

    SHA256

    347e9d55c98bc84cef2d62c5e3ce982c9176bee6df41bdbc7d6f31f25744e198

    SHA512

    10404edb5540983006f3f50754d4babc0d6c35ce6315aff8ef6d3d7aa9e5bd5d9b52f3cb05374be7e317ca2a4ea74af6eec99c72335a5112a5f50c1c77ae1173

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b0494259.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • memory/3364-41-0x0000000000480000-0x000000000048A000-memory.dmp

    Filesize

    40KB

  • memory/4836-28-0x0000000000570000-0x00000000005AE000-memory.dmp

    Filesize

    248KB

  • memory/4836-35-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/4836-34-0x0000000000570000-0x00000000005AE000-memory.dmp

    Filesize

    248KB

  • memory/4948-46-0x0000000002010000-0x000000000209C000-memory.dmp

    Filesize

    560KB

  • memory/4948-53-0x0000000002010000-0x000000000209C000-memory.dmp

    Filesize

    560KB

  • memory/4948-55-0x00000000022E0000-0x00000000022E6000-memory.dmp

    Filesize

    24KB

  • memory/4948-56-0x00000000049E0000-0x0000000004FF8000-memory.dmp

    Filesize

    6.1MB

  • memory/4948-57-0x0000000005070000-0x000000000517A000-memory.dmp

    Filesize

    1.0MB

  • memory/4948-58-0x00000000051A0000-0x00000000051B2000-memory.dmp

    Filesize

    72KB

  • memory/4948-59-0x00000000051C0000-0x00000000051FC000-memory.dmp

    Filesize

    240KB

  • memory/4948-60-0x0000000005230000-0x000000000527C000-memory.dmp

    Filesize

    304KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.