Malware Analysis Report

2025-08-06 00:59

Sample ID 241109-fq5zsaybnk
Target fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae
SHA256 fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae
Tags
healer redline ramon discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae

Threat Level: Known bad

The file fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae was found to be: Known bad.

Malicious Activity Summary

healer redline ramon discovery dropper evasion infostealer persistence trojan

RedLine payload

Modifies Windows Defender Real-time Protection settings

Redline family

Detects Healer an antivirus disabler dropper

RedLine

Healer

Healer family

Executes dropped EXE

Windows security modification

Adds Run key to start application

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 05:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 05:05

Reported

2024-11-09 05:08

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1388 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe
PID 1388 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe
PID 1388 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe
PID 4392 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe
PID 4392 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe
PID 4392 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe
PID 4756 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe
PID 4756 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe
PID 4756 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe
PID 3288 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe
PID 3288 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe
PID 3288 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe
PID 3288 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe
PID 3288 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe

"C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 193.233.20.23:4123 tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
RU 193.233.20.23:4123 tcp
RU 193.233.20.23:4123 tcp
RU 193.233.20.23:4123 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
RU 193.233.20.23:4123 tcp
RU 193.233.20.23:4123 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe

MD5 ea82f09c3a065083098c07d71c4e2b0e
SHA1 893096fde688c579bf20bd9b44c15f92baa77578
SHA256 0dbb4ffa238d218540bd524e5ea3709c138e8dc05a931e48c96ed7f74a6d3f5c
SHA512 7fd91fcdedd400619478009270aa2c4a9c6b480c946a765d62f4a3e03bfb61e39c6ed69312cecd5d37903ce3a25fab4f3dce55692ad28926697daa77b9dcba55

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe

MD5 75c4c78128b3b41822c8b02c2b4937a8
SHA1 da93343b6b705a133a571e789efa5bb054a6086e
SHA256 4939acc5788245a8f4f001a13359fca9cfb84a496679cb2afb12e757e5a16cd1
SHA512 d6fb99399f62a63df2bce2e6d5ca27e73e849b1ef35689b047f31efda89d80ed417a22c26c4e1283f97e16f469b45b4d3bb80de5f15a802ee5314f2565bf60b9

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe

MD5 b5ce76fc9be5b780f077b7caba6fe07c
SHA1 fe77d7bbafe9fa25b636ea50892da8230eccd934
SHA256 26856aab26df5d4128338f18c8d5e68524d904d12d61c5412ac94aeb0c7dc07b
SHA512 c953cd90f9f792fb3dfd6e000fdce7df6b45f26eb7819b87a3a665fd7f832bd15b3b3e5806b35f8cc9fe551c831a30f2b688d1a3cb95a7f11a8a4193e3cb667a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe

MD5 9df47b120c7025ec8ffdc3338bf3371a
SHA1 18c9a5590d838f935ea38598118558686094db80
SHA256 cc881b7786c962ef44b2394705f24fbf1f7964505b2d3322a522a62d838ff829
SHA512 a70ea602160af906fa5958b9d01ee0ddd93bda62c8f5c1ec2632471561df5290ecd8f428f0b3c87bb2fa8a5546bd9e2e5200faa708d62a3ee36df69390227dc4

memory/3000-28-0x0000000000F30000-0x0000000000F3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe

MD5 ce6ca2dd2700dbacf6ba786698d5a344
SHA1 d257c23286fd31ed96f02d6ed2bbc6336c9d7ccf
SHA256 a063bd961d53854a4d95d2293c614f9bd9f0b50352a8f5304e56fa1f7e1824c3
SHA512 1887d1b1f1c601c2d939b79732d4d2fc4d1f4f886eb619f6cb9f6cca25d70a5d7f0d1b99e715822f5aad0d17a14cabac02ec11f2e3d38e871e8c55d587759bde

memory/4796-34-0x0000000004CD0000-0x0000000004D16000-memory.dmp

memory/4796-35-0x0000000007550000-0x0000000007AF4000-memory.dmp

memory/4796-36-0x0000000004EB0000-0x0000000004EF4000-memory.dmp

memory/4796-38-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-40-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-96-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-84-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-54-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-37-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-100-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-98-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-94-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-92-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-90-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-88-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-86-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-82-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-81-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-78-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-77-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-74-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-72-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-71-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-68-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-66-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-64-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-62-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-60-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-58-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-56-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-52-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-50-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-48-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-46-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-44-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-42-0x0000000004EB0000-0x0000000004EEE000-memory.dmp

memory/4796-943-0x0000000007B00000-0x0000000008118000-memory.dmp

memory/4796-944-0x0000000007400000-0x000000000750A000-memory.dmp

memory/4796-945-0x0000000008120000-0x0000000008132000-memory.dmp

memory/4796-946-0x0000000008140000-0x000000000817C000-memory.dmp

memory/4796-947-0x0000000008290000-0x00000000082DC000-memory.dmp