Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 22:19

General

  • Target

    9dd7ea17c0ca5edcb22654bfe7c78b2c04ab23b1f94aa1fa80e0ef01320fd9b2.exe

  • Size

    470KB

  • MD5

    c06546df0e1e0e427f14a9620e78895f

  • SHA1

    56885880b2155bae2d2f4e207fcc07e46ddae47d

  • SHA256

    9dd7ea17c0ca5edcb22654bfe7c78b2c04ab23b1f94aa1fa80e0ef01320fd9b2

  • SHA512

    ea58699ccb827389943490c77ff24721cb3cd5fe23f6a217058ec1968b58ce19fc309d9b2037522773450766ed8eaa4f1ac650841d7b99e95a5f9efa3f46ad62

  • SSDEEP

    12288:LMrZy908fUEsueDW9wl5k3FgqiV9Zq1HD50LVsX:mybUd89mk3WqiVrqT0BsX

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9dd7ea17c0ca5edcb22654bfe7c78b2c04ab23b1f94aa1fa80e0ef01320fd9b2.exe
    "C:\Users\Admin\AppData\Local\Temp\9dd7ea17c0ca5edcb22654bfe7c78b2c04ab23b1f94aa1fa80e0ef01320fd9b2.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nXF05il.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nXF05il.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bgL98Tu.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bgL98Tu.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4844
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1092
          4⤵
          • Program crash
          PID:3812
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dER48gB.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dER48gB.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4952
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4844 -ip 4844
    1⤵
      PID:552
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:3180

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nXF05il.exe

      Filesize

      366KB

      MD5

      b8f7e6454f3a642934c0ed2cbf1ee67b

      SHA1

      e529f9c2293a4ba703e4b9efff0b4f35d9884934

      SHA256

      a766ef62b1e154fbce8a05543071f598c9fc8213f147d1c97ea4cf0c8eda020b

      SHA512

      57ab154eac6e75e4b6ba5fec137e89d80e48e2b22563a9578889b99b931cf950a8c68ad9c28585b6273901c24c081ee09d114af94df5edfcc22e93d3b3259806

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bgL98Tu.exe

      Filesize

      220KB

      MD5

      462c4ee3ed98352a8e3f5b8b1b71dfac

      SHA1

      53e7780c3e7fe6e8fe288bde903d0774210308cf

      SHA256

      6215b8732177d0f5efec6b7e798416a29a67833258ff60860b79eb618d3808d1

      SHA512

      a0a828bbe9f604d66e83be73f6702cd0601adf01115ff1b7497be32d68dad2ae7c199a43ec0fb2f603dd63012a64a35719b9dfaa2e37e2296ef644219fa77989

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dER48gB.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • memory/4844-33-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-49-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-18-0x0000000000400000-0x0000000000754000-memory.dmp

      Filesize

      3.3MB

    • memory/4844-29-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-20-0x0000000004E80000-0x0000000005424000-memory.dmp

      Filesize

      5.6MB

    • memory/4844-21-0x0000000002960000-0x0000000002978000-memory.dmp

      Filesize

      96KB

    • memory/4844-31-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-25-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-47-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-45-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-43-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-42-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-39-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-22-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-35-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-16-0x00000000008B0000-0x00000000008DD000-memory.dmp

      Filesize

      180KB

    • memory/4844-19-0x0000000002540000-0x000000000255A000-memory.dmp

      Filesize

      104KB

    • memory/4844-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4844-37-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-28-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-23-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/4844-50-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

      Filesize

      1024KB

    • memory/4844-51-0x00000000008B0000-0x00000000008DD000-memory.dmp

      Filesize

      180KB

    • memory/4844-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4844-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4844-55-0x0000000000400000-0x0000000000754000-memory.dmp

      Filesize

      3.3MB

    • memory/4844-15-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

      Filesize

      1024KB

    • memory/4952-60-0x0000000000F10000-0x0000000000F42000-memory.dmp

      Filesize

      200KB

    • memory/4952-61-0x0000000005E70000-0x0000000006488000-memory.dmp

      Filesize

      6.1MB

    • memory/4952-62-0x00000000059F0000-0x0000000005AFA000-memory.dmp

      Filesize

      1.0MB

    • memory/4952-63-0x0000000005920000-0x0000000005932000-memory.dmp

      Filesize

      72KB

    • memory/4952-64-0x0000000005980000-0x00000000059BC000-memory.dmp

      Filesize

      240KB

    • memory/4952-65-0x0000000005B00000-0x0000000005B4C000-memory.dmp

      Filesize

      304KB