Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 01:25 UTC

General

  • Target

    a5f0fbc911d801092f455034c1ee2829e0a1296eaf7b8f39c16712b3367f96bb.exe

  • Size

    685KB

  • MD5

    4eeee85e0ca5766cb674427e41216cc8

  • SHA1

    b6f7ab335ca8a58d90f2b5b4d4c99c530a74e956

  • SHA256

    a5f0fbc911d801092f455034c1ee2829e0a1296eaf7b8f39c16712b3367f96bb

  • SHA512

    ca47b3c1f03a5ca1b6c36ac3bc5feaf23ae57e4d7a658b56b933c09deea1f1a7d6f09f0d06e6cca5fcc14c41008cdec0564d807ac03bc26ec164f0ab93934dff

  • SSDEEP

    12288:LMrxy90QKULNUEzjI1u5p9o54pIjwbyODQEJ2xANNKJvfeUp9GphP0yQ:Oybdg1+gG7DhGAKJvfN9aP0n

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5f0fbc911d801092f455034c1ee2829e0a1296eaf7b8f39c16712b3367f96bb.exe
    "C:\Users\Admin\AppData\Local\Temp\a5f0fbc911d801092f455034c1ee2829e0a1296eaf7b8f39c16712b3367f96bb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:116
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYO4816.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYO4816.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3088
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr878460.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr878460.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2280
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku377860.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku377860.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 1384
          4⤵
          • Program crash
          PID:5660
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr250953.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr250953.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:420
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5068 -ip 5068
    1⤵
      PID:5576
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:3656

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      71.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
      Response
      88.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-88deploystaticakamaitechnologiescom
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      66.208.201.84.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      66.208.201.84.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      211.143.182.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      211.143.182.52.in-addr.arpa
      IN PTR
      Response
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      lr250953.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      lr250953.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      lr250953.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      lr250953.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      lr250953.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      104 B
      2
    • 77.91.124.145:4125
      lr250953.exe
      104 B
      2
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      71.31.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      71.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      88.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      88.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      66.208.201.84.in-addr.arpa
      dns
      72 B
      132 B
      1
      1

      DNS Request

      66.208.201.84.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      211.143.182.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      211.143.182.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr250953.exe

      Filesize

      169KB

      MD5

      17152d58df9dba6b55d1b99f68126601

      SHA1

      5fcbb83e7e2bddd6caefa4aac1e7540fab6c4e73

      SHA256

      bd2749bb04f20ea243646fbb683ba733d4b2bf113f91ca2b1959fa0fe06caa4f

      SHA512

      24630b4d08fe9cc10ab768804c9bdb68c2a0f7ebcffd70a5a43e099be4634637964813007331c7a94f040a6c7ed9d35ee5be5f4cf2d1630effbf1d797c3f7a33

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYO4816.exe

      Filesize

      530KB

      MD5

      114017cbdcbde62bbe0f947fad4e8fa5

      SHA1

      5b6cd83523915ee62f5da54a0d60de153d04e6be

      SHA256

      73d4f1485fa87bbb4002f1ac3b7ebe69ac60e9e8828b3e0850ff4200fcba14e2

      SHA512

      33bace48b8ef4be9165336e4bf547168d6d9ac04f89ecd8783e8d1ad4eb7fb345cee13b1cee25d84457602618125379229c86acd9a0f76fedd2bacf49d481a0b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr878460.exe

      Filesize

      12KB

      MD5

      95df5b36ae25e01bb738c7d6ea2a6055

      SHA1

      7f8792a4465884b2c7de22c8e661e6328eb12c3c

      SHA256

      f14b16918bb2ae493be02645953afae559c6aa6f0f0f3f633e361458441e75b4

      SHA512

      76154fb9baeb87da3f7c82eba46dca63e99aa6ea17ea59187a17fc44ea5fc50546d718fb300b07cbc9d56148a47b9533cb8bf94653b9e75cd3bf228a24809f48

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku377860.exe

      Filesize

      495KB

      MD5

      bf44e0c6406210ef2f432fcc760525e7

      SHA1

      1f5dfb50a98ac0779a12d09d49da86f138887319

      SHA256

      bc36c798f0072c3dd399c31125ca0b75254ffbdceb63874365831ef01add0e42

      SHA512

      a14eff46420993fe7528ee104ad3f7790353a95b8151c53e09c2b0a76bddd6e4269eec71c3742815449be96bc8e05cd4dfd293b61bc2fec66e448c442c5cb229

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      1073b2e7f778788852d3f7bb79929882

      SHA1

      7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

      SHA256

      c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

      SHA512

      90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

    • memory/420-2129-0x0000000000CF0000-0x0000000000D1E000-memory.dmp

      Filesize

      184KB

    • memory/420-2130-0x0000000002FD0000-0x0000000002FD6000-memory.dmp

      Filesize

      24KB

    • memory/2280-14-0x00007FFB27603000-0x00007FFB27605000-memory.dmp

      Filesize

      8KB

    • memory/2280-15-0x00000000003F0000-0x00000000003FA000-memory.dmp

      Filesize

      40KB

    • memory/2280-16-0x00007FFB27603000-0x00007FFB27605000-memory.dmp

      Filesize

      8KB

    • memory/5068-62-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-52-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-24-0x0000000005570000-0x00000000055D6000-memory.dmp

      Filesize

      408KB

    • memory/5068-36-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-44-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-86-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-84-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-82-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-80-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-78-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-76-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-74-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-72-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-68-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-67-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-64-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-22-0x0000000002B50000-0x0000000002BB6000-memory.dmp

      Filesize

      408KB

    • memory/5068-60-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-58-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-56-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-54-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-23-0x0000000004F80000-0x0000000005524000-memory.dmp

      Filesize

      5.6MB

    • memory/5068-50-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-48-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-46-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-42-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-40-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-38-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-34-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-32-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-88-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-70-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-30-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-28-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-26-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-25-0x0000000005570000-0x00000000055CF000-memory.dmp

      Filesize

      380KB

    • memory/5068-2105-0x0000000005740000-0x0000000005772000-memory.dmp

      Filesize

      200KB

    • memory/5224-2118-0x0000000000D70000-0x0000000000DA0000-memory.dmp

      Filesize

      192KB

    • memory/5224-2119-0x0000000005540000-0x0000000005546000-memory.dmp

      Filesize

      24KB

    • memory/5224-2120-0x0000000005CC0000-0x00000000062D8000-memory.dmp

      Filesize

      6.1MB

    • memory/5224-2121-0x00000000057B0000-0x00000000058BA000-memory.dmp

      Filesize

      1.0MB

    • memory/5224-2122-0x00000000056E0000-0x00000000056F2000-memory.dmp

      Filesize

      72KB

    • memory/5224-2123-0x0000000005740000-0x000000000577C000-memory.dmp

      Filesize

      240KB

    • memory/5224-2124-0x00000000058C0000-0x000000000590C000-memory.dmp

      Filesize

      304KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.