Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 14:03 UTC

General

  • Target

    e895a41a1164858f7e0954ef5b45e228740c0dcfad9b0988be654eee7aa835c2.exe

  • Size

    470KB

  • MD5

    13b6483961df265f89e61bc3ac782d68

  • SHA1

    f0f44612d3c8ccb538088ca2312f1d238d19a03c

  • SHA256

    e895a41a1164858f7e0954ef5b45e228740c0dcfad9b0988be654eee7aa835c2

  • SHA512

    2e9bf11b3bcc981c8d9ebeb6caa6b34bc709ce8d289d51921177ecdd71db508bc6a8e2a8245ad679e4193d157327287dbf85002ff2e940d3a6dac8d7c2983bee

  • SSDEEP

    12288:KMrly90hL9kqhrzaMGy+EopQb2vbW/D3xkWP5MgO:/yCyaVheeKbWTZ5M5

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e895a41a1164858f7e0954ef5b45e228740c0dcfad9b0988be654eee7aa835c2.exe
    "C:\Users\Admin\AppData\Local\Temp\e895a41a1164858f7e0954ef5b45e228740c0dcfad9b0988be654eee7aa835c2.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ngp77jj.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ngp77jj.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bVn93kC.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bVn93kC.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 1100
          4⤵
          • Program crash
          PID:1236
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnh61rN.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnh61rN.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3456
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1900 -ip 1900
    1⤵
      PID:2384

    Network

    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      76.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 193.233.20.13:4136
      dnh61rN.exe
      260 B
      5
    • 193.233.20.13:4136
      dnh61rN.exe
      260 B
      5
    • 193.233.20.13:4136
      dnh61rN.exe
      260 B
      5
    • 193.233.20.13:4136
      dnh61rN.exe
      260 B
      5
    • 193.233.20.13:4136
      dnh61rN.exe
      260 B
      5
    • 193.233.20.13:4136
      dnh61rN.exe
      156 B
      3
    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      76.32.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      76.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ngp77jj.exe

      Filesize

      366KB

      MD5

      057085711414ee62e4a6a31195295809

      SHA1

      9c8518ff611f776858647b888efa6b884830532b

      SHA256

      229f42c88cddf25539626d67048366b7f1618d9b177c4973d86baa4bd9d46508

      SHA512

      2c016ada00db8016bfd670b61236acb5583443521fd8432d9209500e8896b625dbd33c9647ee246d22c7d264d02d8801d4420dad0bf05e2b98cdaaba94de38c2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bVn93kC.exe

      Filesize

      220KB

      MD5

      fd815ed5f97b5a0c8091f3f8d5125673

      SHA1

      8e062e61dc7fb58a3301741aa4c34b259e3e9b25

      SHA256

      7f2e56fcc1d09a924faf8e9fd38f4781aa79d6d895e8d068d093b4201a3f08e7

      SHA512

      e47b639e4692101ea444ee22b99d638c521ae5c5e8f27b16f9c2f335ab3a242bf0deb51f52a9e75ccb40edffa8bbaaa6cf8915ff74e10be79fbd697fe8ee96b7

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dnh61rN.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • memory/1900-33-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-25-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-18-0x0000000000400000-0x0000000000754000-memory.dmp

      Filesize

      3.3MB

    • memory/1900-19-0x0000000002900000-0x000000000291A000-memory.dmp

      Filesize

      104KB

    • memory/1900-20-0x0000000004E70000-0x0000000005414000-memory.dmp

      Filesize

      5.6MB

    • memory/1900-21-0x0000000002920000-0x0000000002938000-memory.dmp

      Filesize

      96KB

    • memory/1900-47-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-49-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-27-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-43-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-39-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-37-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-35-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-17-0x0000000000400000-0x0000000000754000-memory.dmp

      Filesize

      3.3MB

    • memory/1900-16-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/1900-31-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-45-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-30-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-23-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-22-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-41-0x0000000002920000-0x0000000002932000-memory.dmp

      Filesize

      72KB

    • memory/1900-50-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

      Filesize

      1024KB

    • memory/1900-51-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/1900-54-0x0000000000400000-0x0000000000754000-memory.dmp

      Filesize

      3.3MB

    • memory/1900-55-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/1900-15-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

      Filesize

      1024KB

    • memory/3456-59-0x0000000000340000-0x0000000000372000-memory.dmp

      Filesize

      200KB

    • memory/3456-60-0x0000000005160000-0x0000000005778000-memory.dmp

      Filesize

      6.1MB

    • memory/3456-61-0x0000000004CE0000-0x0000000004DEA000-memory.dmp

      Filesize

      1.0MB

    • memory/3456-62-0x0000000004C10000-0x0000000004C22000-memory.dmp

      Filesize

      72KB

    • memory/3456-63-0x0000000004C90000-0x0000000004CCC000-memory.dmp

      Filesize

      240KB

    • memory/3456-64-0x0000000004DF0000-0x0000000004E3C000-memory.dmp

      Filesize

      304KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.