Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 13:45 UTC

General

  • Target

    9fda643f867efb45dae72af1bbc630b8a21c2e67b949817c696b5f514156b29a.exe

  • Size

    470KB

  • MD5

    99301c3ff246ad836f31a4ec102ad972

  • SHA1

    20269e57b2105ea4ea3db648897885325fd65bcb

  • SHA256

    9fda643f867efb45dae72af1bbc630b8a21c2e67b949817c696b5f514156b29a

  • SHA512

    007c1e500b26c8d87fcca541ce7cfc3cec89752b7f40d7c92614886d555f6f8006fb30ca8daa9e5305f8fcc65ce29e196a313e86f7fd0c4691efe4178d254749

  • SSDEEP

    12288:jMrly90CvQXDrV1h5kehkbXZgczPJOEZzMV:GyBoXXV1rke+J/hOYu

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9fda643f867efb45dae72af1bbc630b8a21c2e67b949817c696b5f514156b29a.exe
    "C:\Users\Admin\AppData\Local\Temp\9fda643f867efb45dae72af1bbc630b8a21c2e67b949817c696b5f514156b29a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nRQ66pQ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nRQ66pQ.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\boa39nl.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\boa39nl.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 1104
          4⤵
          • Program crash
          PID:4140
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUU07Ot.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUU07Ot.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4900
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1980 -ip 1980
    1⤵
      PID:1564
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:4704

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      71.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      74.209.201.84.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      74.209.201.84.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      83.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      83.210.23.2.in-addr.arpa
      IN PTR
      Response
      83.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-83deploystaticakamaitechnologiescom
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 193.233.20.13:4136
      dUU07Ot.exe
      260 B
      5
    • 193.233.20.13:4136
      dUU07Ot.exe
      260 B
      5
    • 193.233.20.13:4136
      dUU07Ot.exe
      260 B
      5
    • 193.233.20.13:4136
      dUU07Ot.exe
      260 B
      5
    • 193.233.20.13:4136
      dUU07Ot.exe
      260 B
      5
    • 193.233.20.13:4136
      dUU07Ot.exe
      156 B
      3
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      71.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      71.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      74.209.201.84.in-addr.arpa
      dns
      72 B
      132 B
      1
      1

      DNS Request

      74.209.201.84.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      83.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      83.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nRQ66pQ.exe

      Filesize

      366KB

      MD5

      40a036ed1c863070adcec33b04c79c46

      SHA1

      13a639946175817060a4f6add81472d5d11d6aa9

      SHA256

      362309419643d15f283416e0d3653c42d8d81e537d120628e43a3d4db4e3176c

      SHA512

      e04accd13acaa57d144d72ed09de4995748cf765d335b594002715ccd1ecea77ead79ab154c8f8c934178b4bc8f3495ff7b4a4b6decf9392270fa15e27204bb9

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\boa39nl.exe

      Filesize

      220KB

      MD5

      7d71db541ff6151995c7b73304ee17f2

      SHA1

      4defdc9e269af4f08e915de5dc319fb2de320a07

      SHA256

      7dc985eb9aa57d698906cc85f11eaf3e8f375c3264b9cef4cebaf4560869444b

      SHA512

      0e3af6fb8ad5648f6ccbc5382a430f27675ceb59352d1a572a8694fb22df46b62a981eda8e010f081020c71027c91a37bdb3d3cf7b9bc944afeb7b3d0f203ced

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUU07Ot.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • memory/1980-31-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-27-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-18-0x0000000000400000-0x0000000000755000-memory.dmp

      Filesize

      3.3MB

    • memory/1980-19-0x0000000002500000-0x000000000251A000-memory.dmp

      Filesize

      104KB

    • memory/1980-20-0x0000000004D90000-0x0000000005334000-memory.dmp

      Filesize

      5.6MB

    • memory/1980-21-0x0000000002700000-0x0000000002718000-memory.dmp

      Filesize

      96KB

    • memory/1980-49-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-47-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-45-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-43-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-41-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-39-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-37-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-35-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-33-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-16-0x00000000008B0000-0x00000000008DD000-memory.dmp

      Filesize

      180KB

    • memory/1980-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/1980-25-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-29-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-23-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-22-0x0000000002700000-0x0000000002712000-memory.dmp

      Filesize

      72KB

    • memory/1980-50-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

      Filesize

      1024KB

    • memory/1980-51-0x00000000008B0000-0x00000000008DD000-memory.dmp

      Filesize

      180KB

    • memory/1980-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/1980-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/1980-55-0x0000000000400000-0x0000000000755000-memory.dmp

      Filesize

      3.3MB

    • memory/1980-15-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

      Filesize

      1024KB

    • memory/4900-60-0x0000000000F10000-0x0000000000F42000-memory.dmp

      Filesize

      200KB

    • memory/4900-61-0x0000000005D50000-0x0000000006368000-memory.dmp

      Filesize

      6.1MB

    • memory/4900-62-0x00000000058B0000-0x00000000059BA000-memory.dmp

      Filesize

      1.0MB

    • memory/4900-63-0x00000000057E0000-0x00000000057F2000-memory.dmp

      Filesize

      72KB

    • memory/4900-64-0x0000000005840000-0x000000000587C000-memory.dmp

      Filesize

      240KB

    • memory/4900-65-0x00000000059C0000-0x0000000005A0C000-memory.dmp

      Filesize

      304KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.