Malware Analysis Report

2025-01-23 06:00

Sample ID 241107-avzqnssamj
Target 8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554
SHA256 8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554
Tags
healer redline diza lada discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554

Threat Level: Known bad

The file 8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554 was found to be: Known bad.

Malicious Activity Summary

healer redline diza lada discovery dropper evasion infostealer persistence trojan

Detects Healer an antivirus disabler dropper

RedLine

Redline family

Healer family

Modifies Windows Defender Real-time Protection settings

RedLine payload

Healer

Checks computer location settings

Windows security modification

Executes dropped EXE

Adds Run key to start application

System Location Discovery: System Language Discovery

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 00:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 00:32

Reported

2024-11-07 00:40

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk538579.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe
PID 2004 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe
PID 2004 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe
PID 5000 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe
PID 5000 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe
PID 5000 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe
PID 4828 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe
PID 4828 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe
PID 4828 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe
PID 4828 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe
PID 4828 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe
PID 4828 wrote to memory of 344 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe
PID 344 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe C:\Windows\Temp\1.exe
PID 344 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe C:\Windows\Temp\1.exe
PID 344 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe C:\Windows\Temp\1.exe
PID 5000 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk538579.exe
PID 5000 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk538579.exe
PID 5000 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk538579.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554.exe

"C:\Users\Admin\AppData\Local\Temp\8b7b44ec3c543dea5c0f011f71278f9eeba2147cd0d562be89fad8c300cca554.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4532 -ip 4532

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 1068

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe

C:\Windows\Temp\1.exe

"C:\Windows\Temp\1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 344 -ip 344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 1516

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk538579.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk538579.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
RU 185.161.248.90:4125 tcp
RU 185.161.248.90:4125 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 185.161.248.90:4125 tcp
RU 185.161.248.90:4125 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
RU 185.161.248.90:4125 tcp
RU 185.161.248.90:4125 tcp
RU 185.161.248.90:4125 tcp
RU 185.161.248.90:4125 tcp
RU 185.161.248.90:4125 tcp
RU 185.161.248.90:4125 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un372336.exe

MD5 6953d1e6e9a051d8d1257c9b5f0a0397
SHA1 b04477685081ffe808b2017aa1f545fe9c933c94
SHA256 97f5dd9b6b794fa7e060e085b3e9537cce929eb1fda07fc2123d10b7f14d1a20
SHA512 f4045be3d90a8396d9e6538b7b4087a282492022f63cd2eec299fe874e407be28fa751d775cbe215b5f29b529e0a2ebc6dd514810fdae74628af147f5cd981df

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un281842.exe

MD5 612ee80ce8aa793f3f2bfa49dcaf6b72
SHA1 e1b2e97b0d2123c987c7e7522ade5b549cb23064
SHA256 385d77d076b639c635f11be86d1776f88ddf877664a27d36015d37fa47690601
SHA512 f7a5f025dee52cc3906e99f7b038f78200101970ac4fd05bbfae8bbb53c99fbc3fcfcdb7e64568a4aafabc7ad8f7c820751ed3e7466f84b5c1e2ba0404222a96

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr604077.exe

MD5 fee1d5d310e0d41eda8d7d65cb9a1a5b
SHA1 e2c9843ac9f09ed272273b8984ba5d778eddb5f1
SHA256 810f294d2c829b5cc5af1b3061f6e3fcefe3f7518341773e2d3e86a8a7298123
SHA512 753ab3a015bf425af4df7c3c876838d5f04752f561d192d24dca6fe778428775d9a7f9e83d9383aaba2fa555dc648dc55c105b727d5c52cba00d23924d276fab

memory/4532-22-0x0000000002580000-0x000000000259A000-memory.dmp

memory/4532-23-0x0000000004F10000-0x00000000054B4000-memory.dmp

memory/4532-24-0x0000000004DC0000-0x0000000004DD8000-memory.dmp

memory/4532-30-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-52-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-50-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-48-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-46-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-44-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-42-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-40-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-38-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-36-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-34-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-32-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-29-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-26-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-25-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

memory/4532-53-0x0000000000400000-0x0000000000809000-memory.dmp

memory/4532-55-0x0000000000400000-0x0000000000809000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu620838.exe

MD5 dff0629229278df8fe1a791e221af012
SHA1 e40c48286ab56d11a5d77d32e52fa455db0fe4e8
SHA256 726f3755e27da48f218ab418a9c5373f319bf1e3dd5513fc6ea51b86aeb9852c
SHA512 e6934c34213853bffbcbd1f2aa865c6b5431a1af9daf5e1323c7d30f9d5e5471be9759c59848d6f22f678597c3578e29b23b9965c3b9e9ce44f664d75788278f

memory/344-61-0x0000000002830000-0x0000000002898000-memory.dmp

memory/344-62-0x0000000002A30000-0x0000000002A96000-memory.dmp

memory/344-74-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-86-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-94-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-92-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-90-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-88-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-84-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-82-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-78-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-72-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-70-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-68-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-80-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-66-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-77-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-63-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-64-0x0000000002A30000-0x0000000002A90000-memory.dmp

memory/344-2205-0x0000000002AE0000-0x0000000002B12000-memory.dmp

C:\Windows\Temp\1.exe

MD5 03728fed675bcde5256342183b1d6f27
SHA1 d13eace7d3d92f93756504b274777cc269b222a2
SHA256 f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA512 6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

memory/1220-2219-0x00000000005B0000-0x00000000005DE000-memory.dmp

memory/1220-2220-0x0000000002880000-0x0000000002886000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk538579.exe

MD5 c52ebada00a59ec1f651a0e9fbcef2eb
SHA1 e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA256 35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA512 6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

memory/1984-2225-0x0000000000940000-0x0000000000970000-memory.dmp

memory/1984-2226-0x0000000005220000-0x0000000005226000-memory.dmp

memory/1220-2227-0x000000000AAC0000-0x000000000B0D8000-memory.dmp

memory/1220-2228-0x000000000A5B0000-0x000000000A6BA000-memory.dmp

memory/1984-2229-0x00000000052D0000-0x00000000052E2000-memory.dmp

memory/1220-2230-0x000000000A4C0000-0x000000000A4FC000-memory.dmp

memory/1220-2231-0x00000000027A0000-0x00000000027EC000-memory.dmp