Malware Analysis Report

2025-01-23 06:48

Sample ID 241105-svbyqasqft
Target 561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584
SHA256 561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584
Tags
healer redline dozt norm discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584

Threat Level: Known bad

The file 561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584 was found to be: Known bad.

Malicious Activity Summary

healer redline dozt norm discovery dropper evasion infostealer persistence trojan

Healer family

Redline family

Healer

Modifies Windows Defender Real-time Protection settings

Detects Healer an antivirus disabler dropper

RedLine

RedLine payload

Checks computer location settings

Windows security modification

Executes dropped EXE

Adds Run key to start application

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-05 15:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-05 15:26

Reported

2024-11-05 15:28

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592298.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2452 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe
PID 2452 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe
PID 2452 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe
PID 2356 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe
PID 2356 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe
PID 2356 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe
PID 2356 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe
PID 2356 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe
PID 4428 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe C:\Windows\Temp\1.exe
PID 4428 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe C:\Windows\Temp\1.exe
PID 4428 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe C:\Windows\Temp\1.exe
PID 2452 wrote to memory of 5672 N/A C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592298.exe
PID 2452 wrote to memory of 5672 N/A C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592298.exe
PID 2452 wrote to memory of 5672 N/A C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592298.exe

Processes

C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe

"C:\Users\Admin\AppData\Local\Temp\561002a29fdd0a06feb1d6c4d67bcbb3c44e4d766eb989065a8bf4e2f8454584.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe

C:\Windows\Temp\1.exe

"C:\Windows\Temp\1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4428 -ip 4428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1492

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592298.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592298.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start wuauserv

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 150.171.28.10:443 g.bing.com tcp
FI 77.91.124.145:4125 tcp
FI 77.91.124.145:4125 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
FI 77.91.124.145:4125 tcp
FI 77.91.124.145:4125 tcp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
FI 77.91.124.145:4125 tcp
FI 77.91.124.145:4125 tcp
FI 77.91.124.145:4125 tcp
FI 77.91.124.145:4125 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
FI 77.91.124.145:4125 tcp
FI 77.91.124.145:4125 tcp
FI 77.91.124.145:4125 tcp
FI 77.91.124.145:4125 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilq7271.exe

MD5 33d9282385180cadff4eafca44c5ba9d
SHA1 55e7f69e078d7fa96c8e62e57c1fd69445208226
SHA256 69d4f2d09499ec8c934a54ca6fd77cd2d8da2bfb19f692dac45626379ac6180f
SHA512 14fb830e6b3395c5bdf059d496f79ddfd2742591445d5967cc3a6940bc05b89fec913368769f1c0f3690bc0c175a92eddb9766044792a6eb394955dd974f1862

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr817130.exe

MD5 95d3149e4eaf4e9cffec290e2378b36f
SHA1 d025f77ad25e1365cacb8fd08b33581408aeae0a
SHA256 0f3c3ae89dd068614108f56d064c19d5b577e4b8e68747e54d4f7340db7fb40d
SHA512 779a4afa0074ad6be356651031c7f211e9c575bfd4e2235e07b9d4f9137d104bc6bf54e2c0ac5d5332455c1c9360eeba8dba4b830b49278787b8cb9c0f5c6d71

memory/2264-14-0x00007FFAF2543000-0x00007FFAF2545000-memory.dmp

memory/2264-15-0x0000000000050000-0x000000000005A000-memory.dmp

memory/2264-16-0x00007FFAF2543000-0x00007FFAF2545000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku699625.exe

MD5 47f3b5f0329ed72b8b3cc071f95ea3fe
SHA1 098e1bbb463b58a1ebec99224466df51e8310b09
SHA256 2aa25ec3430ff6adbbda46fecdbd0c8008a929af93da00cab70ad84e50680845
SHA512 262da340ce3718195cb26230541a9c80863fa12e3d4610017768fe3d11257508de04c9cbfe22602f3ba07eaf0b6f069b28e59fbc34c402e22d8b8f9355f4ee5e

memory/4428-22-0x0000000004C10000-0x0000000004C76000-memory.dmp

memory/4428-23-0x0000000004C80000-0x0000000005224000-memory.dmp

memory/4428-24-0x0000000005230000-0x0000000005296000-memory.dmp

memory/4428-40-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-42-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-88-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-86-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-84-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-82-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-80-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-78-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-76-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-74-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-72-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-70-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-68-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-64-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-62-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-60-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-58-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-56-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-54-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-52-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-50-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-48-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-46-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-44-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-38-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-36-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-35-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-32-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-30-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-28-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-66-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-26-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-25-0x0000000005230000-0x000000000528F000-memory.dmp

memory/4428-2105-0x0000000005400000-0x0000000005432000-memory.dmp

C:\Windows\Temp\1.exe

MD5 1073b2e7f778788852d3f7bb79929882
SHA1 7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256 c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA512 90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

memory/3536-2118-0x0000000000BC0000-0x0000000000BF0000-memory.dmp

memory/3536-2119-0x0000000001230000-0x0000000001236000-memory.dmp

memory/3536-2120-0x0000000005C00000-0x0000000006218000-memory.dmp

memory/3536-2121-0x00000000056F0000-0x00000000057FA000-memory.dmp

memory/3536-2122-0x0000000002DE0000-0x0000000002DF2000-memory.dmp

memory/3536-2123-0x00000000055E0000-0x000000000561C000-memory.dmp

memory/3536-2124-0x0000000005620000-0x000000000566C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr592298.exe

MD5 ab4f34e556ec4099155c4e76a5c82d09
SHA1 a7e583defe4e14bde5ace0547d4c553d0f0c0463
SHA256 4aa2f68107e782318d81f2a53e4736fc644d5bc73730766af271e855be4a6b78
SHA512 5288c61c533203f320d0fb258f22a323ea73948b84903aee24667d9e2c3bf4a958c828340d94052d31f0654b9110663f56a01bea92ebc3a92e388872ae025183

memory/5672-2129-0x0000000000550000-0x0000000000580000-memory.dmp

memory/5672-2130-0x00000000025B0000-0x00000000025B6000-memory.dmp