Malware Analysis Report

2025-08-10 13:17

Sample ID 241109-eh4w3sxcjp
Target 583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d
SHA256 583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d
Tags
healer redline discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d

Threat Level: Known bad

The file 583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d was found to be: Known bad.

Malicious Activity Summary

healer redline discovery dropper evasion infostealer persistence trojan

Healer family

Detects Healer an antivirus disabler dropper

Healer

RedLine

Modifies Windows Defender Real-time Protection settings

Redline family

RedLine payload

Windows security modification

Executes dropped EXE

Adds Run key to start application

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 03:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 03:57

Reported

2024-11-09 03:59

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5068 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe
PID 5068 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe
PID 5068 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe
PID 532 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe
PID 532 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe
PID 532 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe
PID 4920 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe
PID 4920 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe
PID 4920 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe
PID 4920 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe
PID 4920 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe
PID 4920 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe

Processes

C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe

"C:\Users\Admin\AppData\Local\Temp\583bb263cd22e44143c2871a7f787dc56704fde908d09ad6000f6bf4d0da885d.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 964 -ip 964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 1012

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 185.161.248.153:38452 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
RU 185.161.248.153:38452 tcp
RU 185.161.248.153:38452 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
RU 185.161.248.153:38452 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
RU 185.161.248.153:38452 tcp
RU 185.161.248.153:38452 tcp
RU 185.161.248.153:38452 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240096.exe

MD5 a9e6a3be634bf01000c66d441618889a
SHA1 facfbfa31e094fa29ad20f4bb68ee9e02b69afd2
SHA256 bee5a83804b534864320d33d1dbcd28e495c9d831706addaf0760a1831328999
SHA512 f935c154d605fc6f5c8670a04154b0f9d6e9d7d8df9377ea848e59a03010982b1a413015009270af436bb9c843e8a29fac6629257c721ae13930f1ae8d9be70c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un268820.exe

MD5 f64b8d69bcaae2e59553f73cd4040e6c
SHA1 bde6775941f318666424ccc0af259d052caed609
SHA256 d884f3d690e5a0db56e119703f3591e9cb63952d44ae09467c8ee0edbacc363e
SHA512 039137ea54607c3da6d4a5c284b2040882a6f0652d94cbff8bf112b701106271e968b2239033b3ca2d82fcf7d2da45e38b7993a76d717c2b4bbbc7d938001cf3

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr626159.exe

MD5 66a3fcb7f5889b73570758b581abfe24
SHA1 3e39b0c92f43063866c7725b03f46851407bbd3d
SHA256 2355403791a12ccd571cf44ec0451d605d563f04816dce5406f74560265a73f1
SHA512 6a81dfd51478e86a2b09faab56f108cfca63634fb9d00a1eba42057806734b663bc0bac1a55fc2eb8a06a001ef4c0083def19b429505d7623c38b86229129800

memory/964-22-0x0000000004840000-0x000000000485A000-memory.dmp

memory/964-23-0x0000000007240000-0x00000000077E4000-memory.dmp

memory/964-24-0x0000000004C00000-0x0000000004C18000-memory.dmp

memory/964-25-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-52-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-50-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-48-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-46-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-44-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-42-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-40-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-38-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-36-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-34-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-32-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-30-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-28-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-26-0x0000000004C00000-0x0000000004C12000-memory.dmp

memory/964-53-0x0000000000400000-0x0000000002BA6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648139.exe

MD5 a5393eae281839270006e2f299a3ecb5
SHA1 27f0deb89322b09bdd23591c129ad30698a46396
SHA256 62387b38d4f9389377fa017bc045a423b49f267dd784f2743bdf30c40f9f1535
SHA512 c8c2828fa3e8630d86ac7a10af7d2b76aa0c0ab67b34a855d8dc8d76af53e8d61e1c84fa565f19dc90558cbd856cfd994a9266fd4b59c8d1a25a5730376219c5

memory/964-55-0x0000000000400000-0x0000000002BA6000-memory.dmp

memory/448-60-0x0000000007140000-0x000000000717C000-memory.dmp

memory/448-61-0x00000000071C0000-0x00000000071FA000-memory.dmp

memory/448-71-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-79-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-95-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-94-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-91-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-89-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-87-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-85-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-854-0x0000000009D20000-0x000000000A338000-memory.dmp

memory/448-83-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-77-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-855-0x000000000A340000-0x000000000A352000-memory.dmp

memory/448-75-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-73-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-69-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-81-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-67-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-65-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-63-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-62-0x00000000071C0000-0x00000000071F5000-memory.dmp

memory/448-856-0x000000000A360000-0x000000000A46A000-memory.dmp

memory/448-857-0x000000000A490000-0x000000000A4CC000-memory.dmp

memory/448-858-0x0000000004AA0000-0x0000000004AEC000-memory.dmp