Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 13:37 UTC

General

  • Target

    0c4ca8ab6ec588ab54d99e98e16c3a2db703f15904bc5895935144d7f4a460ff.exe

  • Size

    471KB

  • MD5

    30ac4d482a0b5f8a01b7cc320145337f

  • SHA1

    c09ef3297574b2ef7397acb696439f611ba8ce93

  • SHA256

    0c4ca8ab6ec588ab54d99e98e16c3a2db703f15904bc5895935144d7f4a460ff

  • SHA512

    5898cf00d6b77d2e6c2630be3f9d9f41b015d4bf8d4009e6e57dbf22f858fd94449db525f3f99d2687170663188b4b0d04f622914c3e24d3c8229a91fad36add

  • SSDEEP

    12288:9MruAy90bLrVyprtn0kq7Ec3C7A4Subbc77BjHyNbSuWdl+xwhUoG:FAyYrYprtn0XAb7URdHue+xiUoG

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c4ca8ab6ec588ab54d99e98e16c3a2db703f15904bc5895935144d7f4a460ff.exe
    "C:\Users\Admin\AppData\Local\Temp\0c4ca8ab6ec588ab54d99e98e16c3a2db703f15904bc5895935144d7f4a460ff.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nNj71mJ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nNj71mJ.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\byP47fr.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\byP47fr.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2276
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1080
          4⤵
          • Program crash
          PID:4608
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dMm13Ij.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dMm13Ij.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1636
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2276 -ip 2276
    1⤵
      PID:2300
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:4572

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      71.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • 193.233.20.13:4136
      dMm13Ij.exe
      260 B
      5
    • 193.233.20.13:4136
      dMm13Ij.exe
      260 B
      5
    • 193.233.20.13:4136
      dMm13Ij.exe
      260 B
      5
    • 193.233.20.13:4136
      dMm13Ij.exe
      260 B
      5
    • 193.233.20.13:4136
      dMm13Ij.exe
      260 B
      5
    • 193.233.20.13:4136
      dMm13Ij.exe
      208 B
      4
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      71.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      71.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      14.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      14.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nNj71mJ.exe

      Filesize

      367KB

      MD5

      4af34c21370734004856eace239c973f

      SHA1

      9e372aa94d170389a33871f48fbb82a495956bdb

      SHA256

      6a1f0125f56660736ac9e332362ee3318c068141595a190d6671bfc7d56098a8

      SHA512

      12889f1f797b9d1310820ed516390cf12128eb64c5bc8ebdfbf7107ae639e0baf48950350e7639ec0a5748fcd53062cd4375921ea8725a72e2e20509aa9b7a0a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\byP47fr.exe

      Filesize

      222KB

      MD5

      a9a31ca9a35d8caac2f16e884f5132d9

      SHA1

      a9409333bff25265779546cee60a394f51d3ad62

      SHA256

      422112976d1772dc6cf7a79460e8c72acc4b1d156212b15f2f0e8f84b456e32c

      SHA512

      f330ab56bb96bf541edf4d55e739c5bc4031d2c940091ae01991e4ce4e6a9b3fc0adbe05c5fc09601e8ea44eed5ce5c12b73c85961cb12bdfd5a23ab6cec32ca

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dMm13Ij.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • memory/1636-65-0x0000000005720000-0x000000000576C000-memory.dmp

      Filesize

      304KB

    • memory/1636-64-0x00000000055C0000-0x00000000055FC000-memory.dmp

      Filesize

      240KB

    • memory/1636-63-0x0000000005520000-0x0000000005532000-memory.dmp

      Filesize

      72KB

    • memory/1636-62-0x0000000005610000-0x000000000571A000-memory.dmp

      Filesize

      1.0MB

    • memory/1636-61-0x0000000005B20000-0x0000000006138000-memory.dmp

      Filesize

      6.1MB

    • memory/1636-60-0x0000000000C50000-0x0000000000C82000-memory.dmp

      Filesize

      200KB

    • memory/2276-29-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-39-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-47-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-45-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-41-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-37-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-35-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-33-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-31-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-44-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-27-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-23-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-22-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-49-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-25-0x0000000002800000-0x0000000002812000-memory.dmp

      Filesize

      72KB

    • memory/2276-50-0x00000000009B0000-0x0000000000AB0000-memory.dmp

      Filesize

      1024KB

    • memory/2276-51-0x0000000000910000-0x000000000093D000-memory.dmp

      Filesize

      180KB

    • memory/2276-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2276-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2276-55-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2276-21-0x0000000002800000-0x0000000002818000-memory.dmp

      Filesize

      96KB

    • memory/2276-20-0x0000000004FF0000-0x0000000005594000-memory.dmp

      Filesize

      5.6MB

    • memory/2276-19-0x0000000002660000-0x000000000267A000-memory.dmp

      Filesize

      104KB

    • memory/2276-18-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2276-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/2276-16-0x0000000000910000-0x000000000093D000-memory.dmp

      Filesize

      180KB

    • memory/2276-15-0x00000000009B0000-0x0000000000AB0000-memory.dmp

      Filesize

      1024KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.