Malware Analysis Report

2025-08-10 13:16

Sample ID 241109-ehqz8azlen
Target 9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261
SHA256 9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261
Tags
healer redline discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261

Threat Level: Known bad

The file 9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261 was found to be: Known bad.

Malicious Activity Summary

healer redline discovery dropper evasion infostealer persistence trojan

Redline family

Modifies Windows Defender Real-time Protection settings

RedLine

RedLine payload

Detects Healer an antivirus disabler dropper

Healer

Healer family

Windows security modification

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 03:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 03:56

Reported

2024-11-09 03:59

Platform

win7-20241010-en

Max time kernel

144s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3040 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 3040 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 3040 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 3040 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 3040 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 3040 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 3040 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 2744 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2744 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2744 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2744 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2744 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2744 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2744 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2800 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2800 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2800 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2800 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2800 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2800 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2800 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2800 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2800 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2800 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2800 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2800 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2800 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2800 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe

"C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

Network

Country Destination Domain Proto
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp

Files

memory/3040-0-0x0000000000950000-0x0000000000A4C000-memory.dmp

memory/3040-1-0x0000000000950000-0x0000000000A4C000-memory.dmp

memory/3040-2-0x0000000002190000-0x0000000002296000-memory.dmp

memory/3040-3-0x0000000000400000-0x0000000000509000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

MD5 c6335c0a2c1ff34926e5059187fea778
SHA1 47ba414bcea12df8297a1b1a518ab48af68d6a73
SHA256 b60defc60d5c20848132dea613d554a165e7ffe18281d553d43e8669874e3d25
SHA512 ff7ad4f0ab4ad74e43545ff12de51014efc0f89a409dc0ab2eed0e2b40f3c3bbe94c78aa43a6f5f26f72c7ec0dae3ba90d77f94b961d6d2d7671880c042af058

\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

MD5 8f221f63a4b89072b185fd5c0c0db853
SHA1 c13d25faf4c60a435ed2984a5336abf9afb1e351
SHA256 f03de23203170f559ed5427435a3684a17166fa1f1df31bfa16b34935acc4a22
SHA512 983d2c86f6975f2166bfb2bd0d0785bd02b1f18fccfaf9fe72cbf27fa26b2db205fcc8bbbf2371787264f67d3585d8403d9f9353eeabddb679512f0bd8eb6656

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

MD5 5fa4a7916def4bc9c1d11c63ef4896a7
SHA1 f294789c7fc64eebf552838a8aed837d335fd236
SHA256 156b0deb3ab0bf545b6847fbacb2a6e1f6bfc00616b6f165ce3e2a4330c15210
SHA512 f9946ff838f32987d9b84eb66fd92a6bce12b868aabf77f896b7ee360805c143ddbd643cc92de9ce1aae9072d5803bf47b48c7c8335ab0427692e3adc35d43ab

memory/2804-38-0x0000000000E20000-0x0000000000E3A000-memory.dmp

memory/2804-39-0x0000000002680000-0x0000000002698000-memory.dmp

memory/2804-50-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-67-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-65-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-63-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-61-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-59-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-57-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-55-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-53-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-51-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-47-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-46-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-43-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-41-0x0000000002680000-0x0000000002692000-memory.dmp

memory/2804-40-0x0000000002680000-0x0000000002692000-memory.dmp

memory/3040-68-0x0000000000950000-0x0000000000A4C000-memory.dmp

memory/3040-70-0x0000000002190000-0x0000000002296000-memory.dmp

memory/3040-69-0x0000000000400000-0x00000000008E0000-memory.dmp

memory/3040-71-0x0000000000400000-0x0000000000509000-memory.dmp

memory/2804-72-0x0000000000400000-0x0000000000803000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

MD5 bb0616de76770a360d2952b1c7d57d7f
SHA1 1e55af5e66a576a34ef55f0ed7b033101c284883
SHA256 8ca7664fe8080deb4be556ceda8d7df7f48edaa6acd31ebe9ee8e0ae64c4e39c
SHA512 dc486d43808fd3492a34ea2172faeb67be096b1bc79b667108f96fcf6cddd628b244ece608c1d3caceea58dacf1f40ce6435913600bb0e59babcc47541e65d5b

memory/2804-73-0x0000000000400000-0x0000000000803000-memory.dmp

memory/1032-84-0x0000000002230000-0x000000000226C000-memory.dmp

memory/1032-85-0x0000000002280000-0x00000000022BA000-memory.dmp

memory/1032-86-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-87-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-89-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-117-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-115-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-113-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-111-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-109-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-107-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-105-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-103-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-101-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-99-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-97-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-95-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-93-0x0000000002280000-0x00000000022B5000-memory.dmp

memory/1032-91-0x0000000002280000-0x00000000022B5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 03:56

Reported

2024-11-09 03:59

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 952 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 952 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 952 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 3056 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 3056 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 3056 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 1292 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 1292 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 1292 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 1292 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 1292 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 1292 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe

"C:\Users\Admin\AppData\Local\Temp\9cd40de5315ae33b68773190b5e9964d7984418492d5f685e6e2fd2a04a63261.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp

Files

memory/952-1-0x0000000002670000-0x0000000002772000-memory.dmp

memory/952-2-0x0000000002830000-0x0000000002936000-memory.dmp

memory/952-3-0x0000000000400000-0x0000000000509000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

MD5 c6335c0a2c1ff34926e5059187fea778
SHA1 47ba414bcea12df8297a1b1a518ab48af68d6a73
SHA256 b60defc60d5c20848132dea613d554a165e7ffe18281d553d43e8669874e3d25
SHA512 ff7ad4f0ab4ad74e43545ff12de51014efc0f89a409dc0ab2eed0e2b40f3c3bbe94c78aa43a6f5f26f72c7ec0dae3ba90d77f94b961d6d2d7671880c042af058

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

MD5 8f221f63a4b89072b185fd5c0c0db853
SHA1 c13d25faf4c60a435ed2984a5336abf9afb1e351
SHA256 f03de23203170f559ed5427435a3684a17166fa1f1df31bfa16b34935acc4a22
SHA512 983d2c86f6975f2166bfb2bd0d0785bd02b1f18fccfaf9fe72cbf27fa26b2db205fcc8bbbf2371787264f67d3585d8403d9f9353eeabddb679512f0bd8eb6656

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

MD5 5fa4a7916def4bc9c1d11c63ef4896a7
SHA1 f294789c7fc64eebf552838a8aed837d335fd236
SHA256 156b0deb3ab0bf545b6847fbacb2a6e1f6bfc00616b6f165ce3e2a4330c15210
SHA512 f9946ff838f32987d9b84eb66fd92a6bce12b868aabf77f896b7ee360805c143ddbd643cc92de9ce1aae9072d5803bf47b48c7c8335ab0427692e3adc35d43ab

memory/2036-26-0x0000000000400000-0x0000000000803000-memory.dmp

memory/2036-27-0x0000000000400000-0x0000000000803000-memory.dmp

memory/2036-28-0x0000000000400000-0x0000000000803000-memory.dmp

memory/2036-29-0x00000000029F0000-0x0000000002A0A000-memory.dmp

memory/2036-30-0x0000000004F40000-0x00000000054E4000-memory.dmp

memory/2036-31-0x0000000004EE0000-0x0000000004EF8000-memory.dmp

memory/2036-32-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-39-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-59-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-57-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-55-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-53-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-52-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-49-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-47-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-45-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-43-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-41-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-37-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-35-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/2036-33-0x0000000004EE0000-0x0000000004EF2000-memory.dmp

memory/952-60-0x0000000002670000-0x0000000002772000-memory.dmp

memory/952-61-0x0000000002830000-0x0000000002936000-memory.dmp

memory/952-62-0x0000000000400000-0x0000000000509000-memory.dmp

memory/952-63-0x0000000000400000-0x00000000008E0000-memory.dmp

memory/2036-66-0x0000000000400000-0x0000000000803000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

MD5 bb0616de76770a360d2952b1c7d57d7f
SHA1 1e55af5e66a576a34ef55f0ed7b033101c284883
SHA256 8ca7664fe8080deb4be556ceda8d7df7f48edaa6acd31ebe9ee8e0ae64c4e39c
SHA512 dc486d43808fd3492a34ea2172faeb67be096b1bc79b667108f96fcf6cddd628b244ece608c1d3caceea58dacf1f40ce6435913600bb0e59babcc47541e65d5b

memory/888-71-0x0000000002820000-0x000000000285C000-memory.dmp

memory/888-72-0x0000000004DF0000-0x0000000004E2A000-memory.dmp

memory/888-78-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-88-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-104-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-102-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-101-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-96-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-94-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-93-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-90-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-86-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-84-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-82-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-80-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-98-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-76-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-74-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-73-0x0000000004DF0000-0x0000000004E25000-memory.dmp

memory/888-865-0x0000000007930000-0x0000000007F48000-memory.dmp

memory/888-866-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

memory/888-867-0x0000000007FC0000-0x00000000080CA000-memory.dmp

memory/888-868-0x00000000080E0000-0x000000000811C000-memory.dmp

memory/888-869-0x00000000048D0000-0x000000000491C000-memory.dmp