Analysis Overview
SHA256
f825cfeb68d59beea29e523b38b8d7d3a23f36c28a4a6d8ce477aef81f30a802
Threat Level: Known bad
The file f825cfeb68d59beea29e523b38b8d7d3a23f36c28a4a6d8ce477aef81f30a802 was found to be: Known bad.
Malicious Activity Summary
Healer
RedLine payload
RedLine
Healer family
Detects Healer an antivirus disabler dropper
Redline family
Modifies Windows Defender Real-time Protection settings
Windows security modification
Executes dropped EXE
Checks computer location settings
Adds Run key to start application
Launches sc.exe
Unsigned PE
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Program crash
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-07 17:16
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-07 17:16
Reported
2024-11-07 17:18
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Healer family
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu168857.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un630853.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu168857.exe | N/A |
| N/A | N/A | C:\Windows\Temp\1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si999763.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\f825cfeb68d59beea29e523b38b8d7d3a23f36c28a4a6d8ce477aef81f30a802.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un630853.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu168857.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un630853.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu168857.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Temp\1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si999763.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\f825cfeb68d59beea29e523b38b8d7d3a23f36c28a4a6d8ce477aef81f30a802.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu168857.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\f825cfeb68d59beea29e523b38b8d7d3a23f36c28a4a6d8ce477aef81f30a802.exe
"C:\Users\Admin\AppData\Local\Temp\f825cfeb68d59beea29e523b38b8d7d3a23f36c28a4a6d8ce477aef81f30a802.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un630853.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un630853.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2864 -ip 2864
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 1012
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu168857.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu168857.exe
C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1912 -ip 1912
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 1388
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si999763.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si999763.exe
C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.208.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| US | 8.8.8.8:53 | 101.209.201.84.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp | |
| RU | 185.161.248.90:4125 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un630853.exe
| MD5 | bfbb0c10ef51a1e0d644340cf572d6e2 |
| SHA1 | 180a560e0ad6a39f217bbb6c10a42f37ece2d94b |
| SHA256 | eb396eacdd312d694504e671ef2686f02fb3fb3f52ac1d3840a4e6d7d527d6ee |
| SHA512 | fa74207394f99b1260dba71a5aa306e030fcc3325bf80d01912de0d608f94b9ca3f932d19f68f89a0d67b74ac976bd5f591f76c150af0f44258e9752bda68c37 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr566719.exe
| MD5 | b2cd9942453a8df05ea7a889ce99b92b |
| SHA1 | ee54be235ad911fed2a695e990f675ccc74e9236 |
| SHA256 | 03ee7d468c5a6f194ed0ca2d29ea3925fdf54eccb326f21615fdb5bc0a8bd971 |
| SHA512 | 86906146bf5eacb66616b03d5aba2e270a2c6dc6f546211bc0a2a217123ce2e9df082e7fcbf8e2f4ffa52201a2a18181763a8d329d894368d347b07d7f66a6f8 |
memory/2864-15-0x00000000009C0000-0x0000000000AC0000-memory.dmp
memory/2864-16-0x0000000000920000-0x000000000094D000-memory.dmp
memory/2864-17-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2864-18-0x0000000000400000-0x0000000000809000-memory.dmp
memory/2864-19-0x0000000002670000-0x000000000268A000-memory.dmp
memory/2864-20-0x0000000004D90000-0x0000000005334000-memory.dmp
memory/2864-21-0x00000000028D0000-0x00000000028E8000-memory.dmp
memory/2864-47-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-45-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-43-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-41-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-40-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-37-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-49-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-35-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-33-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-31-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-29-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-27-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-25-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-23-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-22-0x00000000028D0000-0x00000000028E2000-memory.dmp
memory/2864-50-0x00000000009C0000-0x0000000000AC0000-memory.dmp
memory/2864-51-0x0000000000920000-0x000000000094D000-memory.dmp
memory/2864-52-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2864-56-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2864-55-0x0000000000400000-0x0000000000809000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu168857.exe
| MD5 | e0db2c5e4838bd26e85300ba8dff48f8 |
| SHA1 | df4d52d8282089a9ab54f7931af9dff9b36d685e |
| SHA256 | 36113573a944ecfba4a34423327c611fbb5851f8e0375ec3be85407f57c6bd30 |
| SHA512 | 72b46b5718b831e1fd1884fd8f70a7cbf6e7ae5d4a319618ef6e9716c49afdde13a8c8a4eaf245b97f28f7a496c84929b35b2e4e2c9318cb242662b6e9c9fd1a |
memory/1912-61-0x0000000004E60000-0x0000000004EC8000-memory.dmp
memory/1912-62-0x0000000005510000-0x0000000005576000-memory.dmp
memory/1912-64-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-80-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-96-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-94-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-92-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-90-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-88-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-86-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-84-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-78-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-76-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-74-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-72-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-70-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-68-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-66-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-82-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-63-0x0000000005510000-0x0000000005570000-memory.dmp
memory/1912-2205-0x0000000005760000-0x0000000005792000-memory.dmp
C:\Windows\Temp\1.exe
| MD5 | 03728fed675bcde5256342183b1d6f27 |
| SHA1 | d13eace7d3d92f93756504b274777cc269b222a2 |
| SHA256 | f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0 |
| SHA512 | 6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1 |
memory/1820-2218-0x0000000000EF0000-0x0000000000F1E000-memory.dmp
memory/1820-2219-0x00000000057D0000-0x00000000057D6000-memory.dmp
memory/1820-2220-0x0000000005E10000-0x0000000006428000-memory.dmp
memory/1820-2221-0x0000000005940000-0x0000000005A4A000-memory.dmp
memory/1820-2222-0x0000000005870000-0x0000000005882000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si999763.exe
| MD5 | c52ebada00a59ec1f651a0e9fbcef2eb |
| SHA1 | e1941278df76616f1ca3202ef2a9f99d2592d52f |
| SHA256 | 35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e |
| SHA512 | 6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2 |
memory/1820-2227-0x00000000058D0000-0x000000000590C000-memory.dmp
memory/1896-2228-0x0000000000150000-0x0000000000180000-memory.dmp
memory/1896-2229-0x0000000000790000-0x0000000000796000-memory.dmp
memory/1820-2230-0x0000000005A50000-0x0000000005A9C000-memory.dmp