Analysis Overview
SHA256
4858006f16420dee035b3049b5e5b9d44dae1e19a10a4d5e5fee3ebcdab96b43
Threat Level: Known bad
The file 4858006f16420dee035b3049b5e5b9d44dae1e19a10a4d5e5fee3ebcdab96b43 was found to be: Known bad.
Malicious Activity Summary
Healer family
Healer
RedLine
Detects Healer an antivirus disabler dropper
RedLine payload
Redline family
Modifies Windows Defender Real-time Protection settings
Windows security modification
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
Launches sc.exe
Unsigned PE
System Location Discovery: System Language Discovery
Program crash
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-07 08:21
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-07 08:21
Reported
2024-11-07 08:26
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
155s
Command Line
Signatures
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Healer family
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868750.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un674319.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868750.exe | N/A |
| N/A | N/A | C:\Windows\Temp\1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si433936.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\4858006f16420dee035b3049b5e5b9d44dae1e19a10a4d5e5fee3ebcdab96b43.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un674319.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868750.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868750.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Temp\1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si433936.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4858006f16420dee035b3049b5e5b9d44dae1e19a10a4d5e5fee3ebcdab96b43.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un674319.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868750.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4858006f16420dee035b3049b5e5b9d44dae1e19a10a4d5e5fee3ebcdab96b43.exe
"C:\Users\Admin\AppData\Local\Temp\4858006f16420dee035b3049b5e5b9d44dae1e19a10a4d5e5fee3ebcdab96b43.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un674319.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un674319.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1764 -ip 1764
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1088
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868750.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868750.exe
C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3104 -ip 3104
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 1384
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si433936.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si433936.exe
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.117.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| US | 8.8.8.8:53 | 25.73.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un674319.exe
| MD5 | e2471d2b4cc94ca0d550fd200d9f4b8c |
| SHA1 | 74c35562542398a2c75dcc4cb12031f1ac2554e1 |
| SHA256 | 744e0e537e4db94cc7f24131114fae00f949a21d42f59afc838515c6debc25d1 |
| SHA512 | a20ff8303f2549ca7b57c9a33631eed877035db911e3012c8daf1538e318d80875851a5ffe94cf63aa155a12955f77dbce861b304e7a4d70c675c9c44f21b9ef |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr926846.exe
| MD5 | 05950832c2d89d8fc0a9bede83778b75 |
| SHA1 | 34854d18daac9ab7ee823887b5538eda9370cea6 |
| SHA256 | 1eefd1ba0fe89b1ab326cf0661522dc91e90cfdd1e65d3a73a8c1392429e1442 |
| SHA512 | 64217aa37138725357fbd27929238190cc13f2a9aa3108acbcc81eb2c4ed99a6b077f26f42d0033ba0742ff0d4efaace6b70f913edd32821d1316bb202ecf0b0 |
memory/1764-15-0x0000000000910000-0x0000000000A10000-memory.dmp
memory/1764-17-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1764-16-0x0000000000A90000-0x0000000000ABD000-memory.dmp
memory/1764-18-0x0000000000400000-0x0000000000809000-memory.dmp
memory/1764-19-0x00000000025A0000-0x00000000025BA000-memory.dmp
memory/1764-20-0x0000000004FE0000-0x0000000005584000-memory.dmp
memory/1764-21-0x0000000002900000-0x0000000002918000-memory.dmp
memory/1764-49-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-47-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-45-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-43-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-41-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-39-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-37-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-35-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-33-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-31-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-29-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-27-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-25-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-23-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-22-0x0000000002900000-0x0000000002912000-memory.dmp
memory/1764-50-0x0000000000910000-0x0000000000A10000-memory.dmp
memory/1764-52-0x0000000000A90000-0x0000000000ABD000-memory.dmp
memory/1764-53-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1764-57-0x0000000000400000-0x0000000000809000-memory.dmp
memory/1764-56-0x0000000000400000-0x0000000000430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu868750.exe
| MD5 | 7c2039b7d52b650872ec0ad50233c8e3 |
| SHA1 | 016cd9bd3d41a88ba65f6c43fc3afc98b3c1a31a |
| SHA256 | 4a5332f63293ee1ba53b074c3bd75f0af8674b28f54910e72af5a8583beb6b00 |
| SHA512 | 741d935a642d97749e8c6ee07d6e3d8822d90ad1b61e7e63557f89d28f5c8f41bcf434bb3b721809acd6c1a55a42d037f755117194374f623049f15823df27d7 |
memory/3104-62-0x0000000004DF0000-0x0000000004E58000-memory.dmp
memory/3104-63-0x0000000005580000-0x00000000055E6000-memory.dmp
memory/3104-69-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-73-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-97-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-95-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-93-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-89-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-87-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-85-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-83-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-81-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-79-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-77-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-75-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-71-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-67-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-91-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-65-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-64-0x0000000005580000-0x00000000055E0000-memory.dmp
memory/3104-2206-0x0000000005770000-0x00000000057A2000-memory.dmp
C:\Windows\Temp\1.exe
| MD5 | 03728fed675bcde5256342183b1d6f27 |
| SHA1 | d13eace7d3d92f93756504b274777cc269b222a2 |
| SHA256 | f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0 |
| SHA512 | 6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1 |
memory/5728-2218-0x0000000000B10000-0x0000000000B3E000-memory.dmp
memory/5728-2220-0x0000000002B80000-0x0000000002B86000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si433936.exe
| MD5 | c52ebada00a59ec1f651a0e9fbcef2eb |
| SHA1 | e1941278df76616f1ca3202ef2a9f99d2592d52f |
| SHA256 | 35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e |
| SHA512 | 6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2 |
memory/2692-2225-0x0000000000E80000-0x0000000000EB0000-memory.dmp
memory/2692-2226-0x0000000003160000-0x0000000003166000-memory.dmp
memory/5728-2227-0x0000000005AA0000-0x00000000060B8000-memory.dmp
memory/2692-2228-0x0000000005960000-0x0000000005A6A000-memory.dmp
memory/2692-2229-0x00000000056F0000-0x0000000005702000-memory.dmp
memory/5728-2230-0x0000000005500000-0x000000000553C000-memory.dmp
memory/2692-2231-0x00000000058D0000-0x000000000591C000-memory.dmp