Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 14:07 UTC

General

  • Target

    d8a6185a14158d457ded655b1dcb4239399a684b6e6086a6b10914cea07befdb.exe

  • Size

    500KB

  • MD5

    9d5e2bfb284c139da1c6d29647b93fdc

  • SHA1

    8c64880c081f22da8a5de2b7eb7421ebbcfb7232

  • SHA256

    d8a6185a14158d457ded655b1dcb4239399a684b6e6086a6b10914cea07befdb

  • SHA512

    ea6851756e656b1aba0633768dfa880b2032c32f7e5fd8178ed43aa04d26fa1834dcd98d71837432928c1653eb73e61dcd6a50548ca5ea5e7a7a64816153a450

  • SSDEEP

    12288:vMrVy90YIfLocRdxzezNR315vK8NsTY0cTy:Cy5IfLo2Hz0319CE0Ky

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8a6185a14158d457ded655b1dcb4239399a684b6e6086a6b10914cea07befdb.exe
    "C:\Users\Admin\AppData\Local\Temp\d8a6185a14158d457ded655b1dcb4239399a684b6e6086a6b10914cea07befdb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nsa13fJ30.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nsa13fJ30.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\doF45PU.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\doF45PU.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1384
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\exa63xa.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\exa63xa.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4876
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1084
          4⤵
          • Program crash
          PID:2524
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fFO93JH.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fFO93JH.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5060
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4876 -ip 4876
    1⤵
      PID:2248
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:644

    Network

    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      134.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      22.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      22.236.111.52.in-addr.arpa
      IN PTR
      Response
    • 193.233.20.13:4136
      fFO93JH.exe
      260 B
      5
    • 193.233.20.13:4136
      fFO93JH.exe
      260 B
      5
    • 193.233.20.13:4136
      fFO93JH.exe
      260 B
      5
    • 193.233.20.13:4136
      fFO93JH.exe
      260 B
      5
    • 193.233.20.13:4136
      fFO93JH.exe
      260 B
      5
    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      134.32.126.40.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      134.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      22.236.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      22.236.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fFO93JH.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nsa13fJ30.exe

      Filesize

      355KB

      MD5

      91072760928c59f55998785fc392eec1

      SHA1

      2b79ebb760bb71e58ac7f94bac0a67a9b38f7958

      SHA256

      aee6e58d7bf809b56a1dc0840b55d8aeaafba83f8bb97ad709fb356deac7658a

      SHA512

      215b3a825757603d1a3278b707158175196f9d6c08dfab617fb5ef45aa4f7a91af04f3fe443e25119823bfd83ff8cd02f3d1087cc0d1b58cf0f816bb4cb95259

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\doF45PU.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\exa63xa.exe

      Filesize

      295KB

      MD5

      95d0521245af8d24fa72f2ce47cded32

      SHA1

      932f5b5afcf601b954e104b99e1ade36ab999751

      SHA256

      97b7275d4ab95bf2c78bef4ac6f1809830f976c9bbdc7b069d9ec9dc11611a1f

      SHA512

      ea320d07786dd617a4450f03f75c8453c3cf70df07cbbce075f45aaf7033be2430798dcccf220e1f8caed30283c235dd1e484d5056152457475ec204153a1c2e

    • memory/1384-14-0x00007FFD63F93000-0x00007FFD63F95000-memory.dmp

      Filesize

      8KB

    • memory/1384-15-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

      Filesize

      40KB

    • memory/1384-16-0x00007FFD63F93000-0x00007FFD63F95000-memory.dmp

      Filesize

      8KB

    • memory/4876-36-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-28-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-51-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-48-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-46-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-44-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-42-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-40-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-38-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-23-0x0000000004C00000-0x00000000051A4000-memory.dmp

      Filesize

      5.6MB

    • memory/4876-34-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-32-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-30-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-24-0x0000000002690000-0x00000000026A8000-memory.dmp

      Filesize

      96KB

    • memory/4876-26-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-25-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-52-0x0000000002690000-0x00000000026A2000-memory.dmp

      Filesize

      72KB

    • memory/4876-53-0x0000000000400000-0x00000000005E3000-memory.dmp

      Filesize

      1.9MB

    • memory/4876-55-0x0000000000400000-0x00000000005E3000-memory.dmp

      Filesize

      1.9MB

    • memory/4876-22-0x00000000023F0000-0x000000000240A000-memory.dmp

      Filesize

      104KB

    • memory/5060-59-0x0000000000900000-0x0000000000932000-memory.dmp

      Filesize

      200KB

    • memory/5060-60-0x0000000005740000-0x0000000005D58000-memory.dmp

      Filesize

      6.1MB

    • memory/5060-61-0x00000000052A0000-0x00000000053AA000-memory.dmp

      Filesize

      1.0MB

    • memory/5060-62-0x00000000051D0000-0x00000000051E2000-memory.dmp

      Filesize

      72KB

    • memory/5060-63-0x0000000005240000-0x000000000527C000-memory.dmp

      Filesize

      240KB

    • memory/5060-64-0x00000000053B0000-0x00000000053FC000-memory.dmp

      Filesize

      304KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.