Analysis Overview
SHA256
897f9a5a31950a353388634d889bf30c290867424b91f776c8381e25ffc6b321
Threat Level: Known bad
The file 897f9a5a31950a353388634d889bf30c290867424b91f776c8381e25ffc6b321 was found to be: Known bad.
Malicious Activity Summary
Detects Healer an antivirus disabler dropper
RedLine payload
Redline family
Healer family
RedLine
Modifies Windows Defender Real-time Protection settings
Healer
Executes dropped EXE
Windows security modification
Adds Run key to start application
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-04 13:53
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-04 13:53
Reported
2024-11-04 13:56
Platform
win10v2004-20241007-en
Max time kernel
143s
Max time network
149s
Command Line
Signatures
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Healer family
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifh1310.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku535982.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifh1310.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\897f9a5a31950a353388634d889bf30c290867424b91f776c8381e25ffc6b321.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\897f9a5a31950a353388634d889bf30c290867424b91f776c8381e25ffc6b321.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifh1310.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku535982.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku535982.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\897f9a5a31950a353388634d889bf30c290867424b91f776c8381e25ffc6b321.exe
"C:\Users\Admin\AppData\Local\Temp\897f9a5a31950a353388634d889bf30c290867424b91f776c8381e25ffc6b321.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifh1310.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifh1310.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku535982.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku535982.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| RU | 176.113.115.145:4125 | tcp | |
| RU | 176.113.115.145:4125 | tcp | |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| RU | 176.113.115.145:4125 | tcp | |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| RU | 176.113.115.145:4125 | tcp | |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| RU | 176.113.115.145:4125 | tcp | |
| RU | 176.113.115.145:4125 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zifh1310.exe
| MD5 | 3b7327651aee311a257229cdb723b238 |
| SHA1 | 6d562a0db86c8855107e3787715416580f9147ff |
| SHA256 | 40f22d4b6a6060b314a2a683bb9fdeef81add2e331c3ccd51e12ebdf223a573c |
| SHA512 | 68a98dca9114dcb5d71da528966f860ec63a0251f7393cfc7b09d1033a4f75ef73385197a3d16e942e99b9da6963a6434bff153b548c0f73b3baf088065a6589 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr818570.exe
| MD5 | a2d7d4a9f5ea770d7c44ca1c4818fbb5 |
| SHA1 | 772cf679871c2ee4d19b31ad46f81adab1a87a02 |
| SHA256 | 65bb14f0621329dd05ab0623eb519c58d98971a8219f080a2002dae0b9daea54 |
| SHA512 | 25d1ddee87a6c0f563cd611a18fcc245b86014091a93c62caaa1b87ed1bdcc0a661797b8867b932db9e850ce928a4e60353b9f89b220c0a4bb234c419b29f7dd |
memory/456-14-0x00007FFDBC7A3000-0x00007FFDBC7A5000-memory.dmp
memory/456-15-0x00000000000E0000-0x00000000000EA000-memory.dmp
memory/456-16-0x00007FFDBC7A3000-0x00007FFDBC7A5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku535982.exe
| MD5 | c3560aa9495453f757b828c247e0482a |
| SHA1 | 27d31845783e4c2de9b043a5bc73eaa83e7e558e |
| SHA256 | eadd07e36ab31cc0557b921d4310cabdeca29d4bfef888917f4f0d3460cd373b |
| SHA512 | 306cacc78e317d2f172c9297c1d6a6a97c726ee92da7c0eee14847dff49247831ea2bd91aca851709bcab11356ea7551cb381a2d8264b21a56a39223f793c5a2 |
memory/2200-22-0x00000000023E0000-0x0000000002426000-memory.dmp
memory/2200-23-0x0000000004C20000-0x00000000051C4000-memory.dmp
memory/2200-24-0x0000000004AB0000-0x0000000004AF4000-memory.dmp
memory/2200-28-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-32-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-88-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-86-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-84-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-82-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-80-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-76-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-74-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-72-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-70-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-68-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-64-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-62-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-60-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-58-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-56-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-54-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-52-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-48-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-46-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-44-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-42-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-40-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-38-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-36-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-31-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-78-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-66-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-50-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-34-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-26-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-25-0x0000000004AB0000-0x0000000004AEF000-memory.dmp
memory/2200-931-0x00000000051D0000-0x00000000057E8000-memory.dmp
memory/2200-932-0x00000000057F0000-0x00000000058FA000-memory.dmp
memory/2200-933-0x0000000004BE0000-0x0000000004BF2000-memory.dmp
memory/2200-934-0x0000000005940000-0x000000000597C000-memory.dmp
memory/2200-935-0x0000000005A80000-0x0000000005ACC000-memory.dmp