Resubmissions

29-10-2024 12:49

241029-p2kbwswqel 10

07-05-2023 07:46

230507-jl68tsfe27 10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-10-2024 12:49

General

  • Target

    e1c3391775dc831ab8c0372a21e935272adb2834b88855bd49a945680340907a.exe

  • Size

    706KB

  • MD5

    a57eaa069601c17aff489167c2a819e5

  • SHA1

    d9087bc4e79264a8a47324c0a373f3a101c083ee

  • SHA256

    e1c3391775dc831ab8c0372a21e935272adb2834b88855bd49a945680340907a

  • SHA512

    8cd870ca8dd9a5b1fca449d7e960efefd6428f8f71cb7112224a0b2701d2660d97661c208a4438a4423770fb897f8d786797ed42f6691fc72e199d7a47a51657

  • SSDEEP

    12288:jy90TiPXDCcW9nLRnB3tcCHzU8j8y+Sr2dg2EoyzPqOzUpNdXtlWRKjp8S:jyQgE9nNB3Nw8WSr2ZTyhzcdXtAcjp8S

Malware Config

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1c3391775dc831ab8c0372a21e935272adb2834b88855bd49a945680340907a.exe
    "C:\Users\Admin\AppData\Local\Temp\e1c3391775dc831ab8c0372a21e935272adb2834b88855bd49a945680340907a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3852
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un460721.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un460721.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr352157.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr352157.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:552
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 972
          4⤵
          • Program crash
          PID:2676
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu619011.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu619011.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2576
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 552 -ip 552
    1⤵
      PID:1500

    Network

    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      205.47.74.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      205.47.74.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.58.199.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.58.199.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      77.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      77.190.18.2.in-addr.arpa
      IN PTR
      Response
      77.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-77deploystaticakamaitechnologiescom
    • flag-us
      DNS
      54.120.234.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      54.120.234.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      self.events.data.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      self.events.data.microsoft.com
      IN A
      Response
      self.events.data.microsoft.com
      IN CNAME
      self-events-data.trafficmanager.net
      self-events-data.trafficmanager.net
      IN CNAME
      onedscolprdeus17.eastus.cloudapp.azure.com
      onedscolprdeus17.eastus.cloudapp.azure.com
      IN A
      20.42.65.91
    • 185.161.248.142:38452
      qu619011.exe
      260 B
      5
    • 185.161.248.142:38452
      qu619011.exe
      260 B
      5
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls
      1.6kB
      7.3kB
      17
      15
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls
      93.0kB
      2.6MB
      1897
      1892
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls
      1.6kB
      7.3kB
      17
      15
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls
      1.6kB
      7.3kB
      17
      15
    • 150.171.27.10:443
      tse1.mm.bing.net
      tls
      1.6kB
      7.3kB
      17
      15
    • 185.161.248.142:38452
      qu619011.exe
      260 B
      5
    • 185.161.248.142:38452
      qu619011.exe
      260 B
      5
    • 185.161.248.142:38452
      qu619011.exe
      260 B
      5
    • 185.161.248.142:38452
      qu619011.exe
      260 B
      5
    • 185.161.248.142:38452
      qu619011.exe
      208 B
      4
    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      433 B
      943 B
      6
      6

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      205.47.74.20.in-addr.arpa

      DNS Request

      43.58.199.20.in-addr.arpa

      DNS Request

      77.190.18.2.in-addr.arpa

      DNS Request

      54.120.234.20.in-addr.arpa

      DNS Request

      self.events.data.microsoft.com

      DNS Response

      20.42.65.91

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un460721.exe

      Filesize

      551KB

      MD5

      a4c8943c5d021f12d17f93c6328328c4

      SHA1

      68ea049990962d746b6a536ed674e1566c44ead3

      SHA256

      baf59f967c98b99115168a74d1516e332573078399aff17ae49c1df8974db623

      SHA512

      269c3aa7c3588303d1157a98de77a67fad3fac50f80241778977f965c0ba1cec961f69368ecb7f77a1f3c621e04e5d70bbec4477d3c9f1f1c31d3264882d8657

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr352157.exe

      Filesize

      286KB

      MD5

      a3c21d10a14315f68dc2329de4977403

      SHA1

      4a3fc4564ecbec45ff388773a5ddad89280b26b7

      SHA256

      382f2509df79a2fa34653bd0f9763971b0b4bc2bcb5142b9b1034b03a95fbed9

      SHA512

      2ad2b31d462d0faf34027a896dbd9ceaef2febb133b4df932dd9db1007c177c9fa5cc8506b7f6c6bb9a88b410201661c8479adc8be85eff93ee1ba724922efbd

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu619011.exe

      Filesize

      369KB

      MD5

      4b4514014cf7f85a6bc70736dac74ab5

      SHA1

      f1804216e8fbb186c377195b6afe78c1cb7266f1

      SHA256

      a2e1a1f6f4635554a4d5dc9741f612d25284338d5ef80e43d609f722881886ad

      SHA512

      3154e109f747fd30bb745a4236c1dc384e9a51a3ed90a2837cf39abed3cff9c3e6010e840a3834fe6dd6438c713e60e670028e82b8ec55e2576624463da377c0

    • memory/552-15-0x0000000002D70000-0x0000000002E70000-memory.dmp

      Filesize

      1024KB

    • memory/552-16-0x0000000002EA0000-0x0000000002ECD000-memory.dmp

      Filesize

      180KB

    • memory/552-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/552-18-0x0000000004CB0000-0x0000000004CCA000-memory.dmp

      Filesize

      104KB

    • memory/552-19-0x00000000074F0000-0x0000000007A96000-memory.dmp

      Filesize

      5.6MB

    • memory/552-20-0x0000000004E50000-0x0000000004E68000-memory.dmp

      Filesize

      96KB

    • memory/552-21-0x0000000000400000-0x0000000002BB1000-memory.dmp

      Filesize

      39.7MB

    • memory/552-49-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-48-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-45-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-43-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-41-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-39-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-37-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-35-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-33-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-31-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-29-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-27-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-25-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-23-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-22-0x0000000004E50000-0x0000000004E62000-memory.dmp

      Filesize

      72KB

    • memory/552-50-0x0000000002D70000-0x0000000002E70000-memory.dmp

      Filesize

      1024KB

    • memory/552-51-0x0000000002EA0000-0x0000000002ECD000-memory.dmp

      Filesize

      180KB

    • memory/552-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/552-54-0x0000000000400000-0x0000000002BB1000-memory.dmp

      Filesize

      39.7MB

    • memory/552-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2576-61-0x0000000004E50000-0x0000000004E8C000-memory.dmp

      Filesize

      240KB

    • memory/2576-62-0x0000000004F10000-0x0000000004F4A000-memory.dmp

      Filesize

      232KB

    • memory/2576-66-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-68-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-96-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-94-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-90-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-88-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-86-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-855-0x0000000009EF0000-0x000000000A508000-memory.dmp

      Filesize

      6.1MB

    • memory/2576-856-0x0000000005060000-0x0000000005072000-memory.dmp

      Filesize

      72KB

    • memory/2576-84-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-82-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-80-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-78-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-857-0x000000000A510000-0x000000000A61A000-memory.dmp

      Filesize

      1.0MB

    • memory/2576-76-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-74-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-72-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-70-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-92-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-64-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-63-0x0000000004F10000-0x0000000004F45000-memory.dmp

      Filesize

      212KB

    • memory/2576-858-0x00000000074F0000-0x000000000752C000-memory.dmp

      Filesize

      240KB

    • memory/2576-859-0x0000000007560000-0x00000000075AC000-memory.dmp

      Filesize

      304KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.