Analysis Overview
SHA256
fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae
Threat Level: Known bad
The file fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae was found to be: Known bad.
Malicious Activity Summary
RedLine payload
Modifies Windows Defender Real-time Protection settings
Redline family
Detects Healer an antivirus disabler dropper
RedLine
Healer
Healer family
Executes dropped EXE
Windows security modification
Adds Run key to start application
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-09 05:05
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-09 05:05
Reported
2024-11-09 05:08
Platform
win10v2004-20241007-en
Max time kernel
144s
Max time network
148s
Command Line
Signatures
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Healer family
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe
"C:\Users\Admin\AppData\Local\Temp\fc7f023d5ad6d2412d3a3d76415d4938a0a8da5757139497a7a7d6b83280c1ae.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| RU | 193.233.20.23:4123 | tcp | |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| RU | 193.233.20.23:4123 | tcp | |
| RU | 193.233.20.23:4123 | tcp | |
| RU | 193.233.20.23:4123 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| RU | 193.233.20.23:4123 | tcp | |
| RU | 193.233.20.23:4123 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sly79Yl47.exe
| MD5 | ea82f09c3a065083098c07d71c4e2b0e |
| SHA1 | 893096fde688c579bf20bd9b44c15f92baa77578 |
| SHA256 | 0dbb4ffa238d218540bd524e5ea3709c138e8dc05a931e48c96ed7f74a6d3f5c |
| SHA512 | 7fd91fcdedd400619478009270aa2c4a9c6b480c946a765d62f4a3e03bfb61e39c6ed69312cecd5d37903ce3a25fab4f3dce55692ad28926697daa77b9dcba55 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\syC90VX44.exe
| MD5 | 75c4c78128b3b41822c8b02c2b4937a8 |
| SHA1 | da93343b6b705a133a571e789efa5bb054a6086e |
| SHA256 | 4939acc5788245a8f4f001a13359fca9cfb84a496679cb2afb12e757e5a16cd1 |
| SHA512 | d6fb99399f62a63df2bce2e6d5ca27e73e849b1ef35689b047f31efda89d80ed417a22c26c4e1283f97e16f469b45b4d3bb80de5f15a802ee5314f2565bf60b9 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sYX44KV14.exe
| MD5 | b5ce76fc9be5b780f077b7caba6fe07c |
| SHA1 | fe77d7bbafe9fa25b636ea50892da8230eccd934 |
| SHA256 | 26856aab26df5d4128338f18c8d5e68524d904d12d61c5412ac94aeb0c7dc07b |
| SHA512 | c953cd90f9f792fb3dfd6e000fdce7df6b45f26eb7819b87a3a665fd7f832bd15b3b3e5806b35f8cc9fe551c831a30f2b688d1a3cb95a7f11a8a4193e3cb667a |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iNR23cC50.exe
| MD5 | 9df47b120c7025ec8ffdc3338bf3371a |
| SHA1 | 18c9a5590d838f935ea38598118558686094db80 |
| SHA256 | cc881b7786c962ef44b2394705f24fbf1f7964505b2d3322a522a62d838ff829 |
| SHA512 | a70ea602160af906fa5958b9d01ee0ddd93bda62c8f5c1ec2632471561df5290ecd8f428f0b3c87bb2fa8a5546bd9e2e5200faa708d62a3ee36df69390227dc4 |
memory/3000-28-0x0000000000F30000-0x0000000000F3A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kFc15ja65.exe
| MD5 | ce6ca2dd2700dbacf6ba786698d5a344 |
| SHA1 | d257c23286fd31ed96f02d6ed2bbc6336c9d7ccf |
| SHA256 | a063bd961d53854a4d95d2293c614f9bd9f0b50352a8f5304e56fa1f7e1824c3 |
| SHA512 | 1887d1b1f1c601c2d939b79732d4d2fc4d1f4f886eb619f6cb9f6cca25d70a5d7f0d1b99e715822f5aad0d17a14cabac02ec11f2e3d38e871e8c55d587759bde |
memory/4796-34-0x0000000004CD0000-0x0000000004D16000-memory.dmp
memory/4796-35-0x0000000007550000-0x0000000007AF4000-memory.dmp
memory/4796-36-0x0000000004EB0000-0x0000000004EF4000-memory.dmp
memory/4796-38-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-40-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-96-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-84-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-54-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-37-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-100-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-98-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-94-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-92-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-90-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-88-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-86-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-82-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-81-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-78-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-77-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-74-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-72-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-71-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-68-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-66-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-64-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-62-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-60-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-58-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-56-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-52-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-50-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-48-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-46-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-44-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-42-0x0000000004EB0000-0x0000000004EEE000-memory.dmp
memory/4796-943-0x0000000007B00000-0x0000000008118000-memory.dmp
memory/4796-944-0x0000000007400000-0x000000000750A000-memory.dmp
memory/4796-945-0x0000000008120000-0x0000000008132000-memory.dmp
memory/4796-946-0x0000000008140000-0x000000000817C000-memory.dmp
memory/4796-947-0x0000000008290000-0x00000000082DC000-memory.dmp