Analysis

  • max time kernel
    126s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 05:33

General

  • Target

    abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe

  • Size

    478KB

  • MD5

    87d0f8209c784d8b514ac512998f25bf

  • SHA1

    82be5d34df215e7f4a6f7e3e1866aa12c6341c3d

  • SHA256

    abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47

  • SHA512

    64024a1e685c9df1cf57721110c38039c80662d9511ff31478f04b494f126d18a38e7bc8eaec9a6f99cf280238adbbe5b13c7716e3f03ea135c083c75580dbfd

  • SSDEEP

    6144:Ksy+bnr+ep0yN90QEUnLAJAyUoV2oJkBAsKg0LQSFTFO/vUtYgudY4O6SKRmUY0k:MMr2y90+HoVkB+gSFs3Uj7FKRm4Z+5

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe
    "C:\Users\Admin\AppData\Local\Temp\abe0d911273c33cc80e1fd2353206c022ca128d45e485f16cde0bd9c8ee61c47.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYC92TT60.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYC92TT60.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:928
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dXS04Fv.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dXS04Fv.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ecB28HQ.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ecB28HQ.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1280
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 1084
          4⤵
          • Program crash
          PID:716
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fok25Ta.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fok25Ta.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1632
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1280 -ip 1280
    1⤵
      PID:1276

    Network

    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      17.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      73.209.201.84.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.209.201.84.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 193.233.20.13:4136
      fok25Ta.exe
      260 B
      5
    • 193.233.20.13:4136
      fok25Ta.exe
      260 B
      5
    • 193.233.20.13:4136
      fok25Ta.exe
      260 B
      5
    • 193.233.20.13:4136
      fok25Ta.exe
      260 B
      5
    • 193.233.20.13:4136
      fok25Ta.exe
      260 B
      5
    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      17.160.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      17.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      73.209.201.84.in-addr.arpa
      dns
      72 B
      132 B
      1
      1

      DNS Request

      73.209.201.84.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fok25Ta.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nYC92TT60.exe

      Filesize

      333KB

      MD5

      38b3c72de817bc8325d966644b3ab2ea

      SHA1

      56511d41f43b2d12791142e3ac67bb726d37f303

      SHA256

      2a72ed7f205a5e893912ce8618918c00dd94b09e7f9a52a81f3cab3ededc4994

      SHA512

      1c14c018530c970b23eb5a57670091f6c3e58550677541b201c0e101a09a3a2d13ec1c148f3d54da2f39c9443efdd531d75536adf41382eb3068d768bc69cec5

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dXS04Fv.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ecB28HQ.exe

      Filesize

      235KB

      MD5

      51eaf3c9171c3352f9656cae26564893

      SHA1

      f34140400948baf80b116d9d59839a3f9018168d

      SHA256

      7f83dffe8e01e47ab8e070ff65d79e728d717efac490183e68ba36908fd2a720

      SHA512

      dff81178fc1a2e66e701a722244f2bba11994762f11fac71880f82eb816183e61f203fc0ad5adbaa17992f6ccad63f962420a3037ecfc35a21de8af8e091fe02

    • memory/1280-42-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-40-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-22-0x00000000025C0000-0x00000000025DA000-memory.dmp

      Filesize

      104KB

    • memory/1280-23-0x0000000004D80000-0x0000000005324000-memory.dmp

      Filesize

      5.6MB

    • memory/1280-24-0x00000000029B0000-0x00000000029C8000-memory.dmp

      Filesize

      96KB

    • memory/1280-25-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-32-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-52-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-50-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-48-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-46-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-44-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-54-0x0000000000400000-0x0000000000759000-memory.dmp

      Filesize

      3.3MB

    • memory/1280-26-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-38-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-36-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-34-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-30-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1280-28-0x00000000029B0000-0x00000000029C2000-memory.dmp

      Filesize

      72KB

    • memory/1632-59-0x00000000009F0000-0x0000000000A22000-memory.dmp

      Filesize

      200KB

    • memory/1632-60-0x0000000005820000-0x0000000005E38000-memory.dmp

      Filesize

      6.1MB

    • memory/1632-61-0x0000000005390000-0x000000000549A000-memory.dmp

      Filesize

      1.0MB

    • memory/1632-62-0x00000000052C0000-0x00000000052D2000-memory.dmp

      Filesize

      72KB

    • memory/1632-63-0x0000000005320000-0x000000000535C000-memory.dmp

      Filesize

      240KB

    • memory/1632-64-0x00000000054A0000-0x00000000054EC000-memory.dmp

      Filesize

      304KB

    • memory/4756-16-0x00007FF887873000-0x00007FF887875000-memory.dmp

      Filesize

      8KB

    • memory/4756-15-0x0000000000250000-0x000000000025A000-memory.dmp

      Filesize

      40KB

    • memory/4756-14-0x00007FF887873000-0x00007FF887875000-memory.dmp

      Filesize

      8KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.