Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 13:57

General

  • Target

    089b31c2dd81074580b8cc46c75b97bc23be1e2148b0069f79d7699e23785f32.exe

  • Size

    478KB

  • MD5

    b2d8db6a33722d4cba42fe1057f571f3

  • SHA1

    fea558c889f6ed1026884548a7e340f5455051a1

  • SHA256

    089b31c2dd81074580b8cc46c75b97bc23be1e2148b0069f79d7699e23785f32

  • SHA512

    debb37760f24f8469e1f5822a1f851db44dd81c902b5ec1bd61a71eec41d5e40720d14a5542a47341a20797bd95fa423e1af2f332918ddd83060882b773b8489

  • SSDEEP

    12288:RMrLy90pBHDjAGQLOUl74YWaeWZH+y2y8fLWYxe2xdTjr:iySBUOUSzHyOLWNm

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\089b31c2dd81074580b8cc46c75b97bc23be1e2148b0069f79d7699e23785f32.exe
    "C:\Users\Admin\AppData\Local\Temp\089b31c2dd81074580b8cc46c75b97bc23be1e2148b0069f79d7699e23785f32.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVn06sk.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVn06sk.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bST09Ny.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bST09Ny.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4504
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 1084
          4⤵
          • Program crash
          PID:4776
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dMM53PP.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dMM53PP.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5096
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4504 -ip 4504
    1⤵
      PID:2592
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:4452

    Network

    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      69.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      69.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.42.69.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.42.69.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 193.233.20.13:4136
      dMM53PP.exe
      260 B
      5
    • 193.233.20.13:4136
      dMM53PP.exe
      260 B
      5
    • 193.233.20.13:4136
      dMM53PP.exe
      260 B
      5
    • 193.233.20.13:4136
      dMM53PP.exe
      260 B
      5
    • 193.233.20.13:4136
      dMM53PP.exe
      260 B
      5
    • 193.233.20.13:4136
      dMM53PP.exe
      156 B
      3
    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      69.31.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      69.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      241.42.69.40.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      241.42.69.40.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVn06sk.exe

      Filesize

      374KB

      MD5

      ebd8a896d3cf30bf44504e71cff5010c

      SHA1

      2aeb8337a175f33dc649fc57966cea8782801aa0

      SHA256

      a64003b62a73222c7e31b13813dbc26bcff3fdb878f684dda22f8f44df2c068c

      SHA512

      cef59eca1377f456c571db525cb672def3c5ec473a4c606dfa1249b760b4e63c53f07aaf787cb03bf3dfd9ee22b45d311943c67be083677b8fb35a23402d2336

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bST09Ny.exe

      Filesize

      235KB

      MD5

      760791b22909e7d142a6c97e4aa18476

      SHA1

      912f22fb3409888fda2e71d7868242bad21681e2

      SHA256

      30a7dd0b713c452b66bbe4dbde9f345919d3fb2b8fdbd0b2afe00c0913dd4c2d

      SHA512

      415657cf57d4a74e8a221939a091b9ad87aad4ccd55d8667d8bfdd5b8a93a02ab359543a7ff936fdc866be5a39f0b4b73822f385dc9000d1a97a9d5f117a156e

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dMM53PP.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • memory/4504-31-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-49-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-18-0x0000000000400000-0x0000000000759000-memory.dmp

      Filesize

      3.3MB

    • memory/4504-29-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-20-0x0000000004D10000-0x00000000052B4000-memory.dmp

      Filesize

      5.6MB

    • memory/4504-21-0x00000000052C0000-0x00000000052D8000-memory.dmp

      Filesize

      96KB

    • memory/4504-33-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-25-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-47-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-45-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-43-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-41-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-39-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-23-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-35-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-16-0x0000000000890000-0x00000000008BD000-memory.dmp

      Filesize

      180KB

    • memory/4504-19-0x0000000004C80000-0x0000000004C9A000-memory.dmp

      Filesize

      104KB

    • memory/4504-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4504-37-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-22-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-27-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/4504-50-0x00000000008C0000-0x00000000009C0000-memory.dmp

      Filesize

      1024KB

    • memory/4504-51-0x0000000000890000-0x00000000008BD000-memory.dmp

      Filesize

      180KB

    • memory/4504-52-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4504-55-0x0000000000400000-0x0000000000759000-memory.dmp

      Filesize

      3.3MB

    • memory/4504-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

    • memory/4504-15-0x00000000008C0000-0x00000000009C0000-memory.dmp

      Filesize

      1024KB

    • memory/5096-60-0x0000000000530000-0x0000000000562000-memory.dmp

      Filesize

      200KB

    • memory/5096-61-0x0000000005350000-0x0000000005968000-memory.dmp

      Filesize

      6.1MB

    • memory/5096-62-0x0000000004ED0000-0x0000000004FDA000-memory.dmp

      Filesize

      1.0MB

    • memory/5096-63-0x0000000004E00000-0x0000000004E12000-memory.dmp

      Filesize

      72KB

    • memory/5096-64-0x0000000004E60000-0x0000000004E9C000-memory.dmp

      Filesize

      240KB

    • memory/5096-65-0x0000000004FE0000-0x000000000502C000-memory.dmp

      Filesize

      304KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.