Analysis

  • max time kernel
    127s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 12:22

General

  • Target

    aa58c907b78987e09e3a485fbfb29d96b187dbcf2e26ff28173ad1972aa7c9a7.exe

  • Size

    500KB

  • MD5

    a5a111336950d4a7ee86f75d0e5bdb4f

  • SHA1

    65b5745bac5d5e01f5264ee3a74c952f43c4b302

  • SHA256

    aa58c907b78987e09e3a485fbfb29d96b187dbcf2e26ff28173ad1972aa7c9a7

  • SHA512

    aeffbc01e6128729a6851ce911a7664ee28eb1c4f1a3c0c66fba98fd630d2abc56bf8a7a54ccd749c084b35fdfe89c442ee1d463e4d010fb56527b9522fec15b

  • SSDEEP

    12288:QMrzy90OIRDaZ9KQAsQ2F5/2zprdWpZGy:zy2l28NXEOzlopZGy

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa58c907b78987e09e3a485fbfb29d96b187dbcf2e26ff28173ad1972aa7c9a7.exe
    "C:\Users\Admin\AppData\Local\Temp\aa58c907b78987e09e3a485fbfb29d96b187dbcf2e26ff28173ad1972aa7c9a7.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nAp54yj56.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nAp54yj56.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dns95MX.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dns95MX.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1540
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eqt39Pz.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eqt39Pz.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3288
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 1088
          4⤵
          • Program crash
          PID:1044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fKO62eE.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fKO62eE.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3288 -ip 3288
    1⤵
      PID:1576

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 193.233.20.13:4136
      fKO62eE.exe
      260 B
      5
    • 193.233.20.13:4136
      fKO62eE.exe
      260 B
      5
    • 193.233.20.13:4136
      fKO62eE.exe
      260 B
      5
    • 193.233.20.13:4136
      fKO62eE.exe
      260 B
      5
    • 193.233.20.13:4136
      fKO62eE.exe
      260 B
      5
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fKO62eE.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nAp54yj56.exe

      Filesize

      355KB

      MD5

      3931e0715e9d4bc520df6831e3306e37

      SHA1

      d5be6b9c95eade84382e0ba143951a71e4bcdcce

      SHA256

      b150a4479c38a6623720d201c2f679ed012a1f0b44fc3b77a309e43da79957fb

      SHA512

      cfab04f74b1c8039ff3bde8fa888aed6017eafd10834b4bbbcfb2194fe8db95983c5125c134cc1eb427a002f0aafbf357e0dde682696183abb50a751df6e8833

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dns95MX.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eqt39Pz.exe

      Filesize

      295KB

      MD5

      304766f61a677814af31d2737d118b6f

      SHA1

      213a7e70d4f7d13e17ddff12152bcfe2c1cc2de4

      SHA256

      07c33396ed7ec1b40808aae921c50c552dc21b08beabbd5541b9fc9f062e08ac

      SHA512

      08c9202e988e4f6518a14f37b19eefc8b5901a2c07472140303c48535b67830e956759db3738b3bf63559220cb1e59f8045a2fad5d84530e9cb2e670740441ea

    • memory/1540-14-0x00007FFA4C223000-0x00007FFA4C225000-memory.dmp

      Filesize

      8KB

    • memory/1540-15-0x00000000002B0000-0x00000000002BA000-memory.dmp

      Filesize

      40KB

    • memory/1540-16-0x00007FFA4C223000-0x00007FFA4C225000-memory.dmp

      Filesize

      8KB

    • memory/2964-64-0x0000000005390000-0x00000000053DC000-memory.dmp

      Filesize

      304KB

    • memory/2964-62-0x00000000051B0000-0x00000000051C2000-memory.dmp

      Filesize

      72KB

    • memory/2964-61-0x0000000005280000-0x000000000538A000-memory.dmp

      Filesize

      1.0MB

    • memory/2964-60-0x0000000005720000-0x0000000005D38000-memory.dmp

      Filesize

      6.1MB

    • memory/2964-59-0x00000000007B0000-0x00000000007E2000-memory.dmp

      Filesize

      200KB

    • memory/2964-63-0x0000000005220000-0x000000000525C000-memory.dmp

      Filesize

      240KB

    • memory/3288-42-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-28-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-44-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-48-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-40-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-38-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-36-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-34-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-30-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-46-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-26-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-53-0x0000000000400000-0x00000000005C6000-memory.dmp

      Filesize

      1.8MB

    • memory/3288-55-0x0000000000400000-0x00000000005C6000-memory.dmp

      Filesize

      1.8MB

    • memory/3288-51-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-52-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-32-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-25-0x00000000024C0000-0x00000000024D2000-memory.dmp

      Filesize

      72KB

    • memory/3288-24-0x00000000024C0000-0x00000000024D8000-memory.dmp

      Filesize

      96KB

    • memory/3288-23-0x0000000004F40000-0x00000000054E4000-memory.dmp

      Filesize

      5.6MB

    • memory/3288-22-0x0000000000890000-0x00000000008AA000-memory.dmp

      Filesize

      104KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.