Malware Analysis Report

2024-12-06 02:40

Sample ID 241110-a9y3paynal
Target b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d
SHA256 b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d
Tags
healer redline discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d

Threat Level: Known bad

The file b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d was found to be: Known bad.

Malicious Activity Summary

healer redline discovery dropper evasion infostealer persistence trojan

Healer

RedLine

Redline family

Modifies Windows Defender Real-time Protection settings

Detects Healer an antivirus disabler dropper

RedLine payload

Healer family

Loads dropped DLL

Executes dropped EXE

Windows security modification

Adds Run key to start application

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 00:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 00:55

Reported

2024-11-10 00:57

Platform

win7-20240708-en

Max time kernel

142s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2308 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 2308 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 2308 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 2308 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 2308 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 2308 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 2308 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 2664 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2664 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2664 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2664 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2664 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2664 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2664 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 2712 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2712 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2712 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2712 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2712 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2712 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2712 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 2712 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2712 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2712 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2712 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2712 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2712 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 2712 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe

"C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

Network

Country Destination Domain Proto
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp

Files

memory/2308-0-0x00000000008E0000-0x00000000009DC000-memory.dmp

memory/2308-4-0x0000000002260000-0x0000000002366000-memory.dmp

memory/2308-1-0x00000000008E0000-0x00000000009DC000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

MD5 c6335c0a2c1ff34926e5059187fea778
SHA1 47ba414bcea12df8297a1b1a518ab48af68d6a73
SHA256 b60defc60d5c20848132dea613d554a165e7ffe18281d553d43e8669874e3d25
SHA512 ff7ad4f0ab4ad74e43545ff12de51014efc0f89a409dc0ab2eed0e2b40f3c3bbe94c78aa43a6f5f26f72c7ec0dae3ba90d77f94b961d6d2d7671880c042af058

memory/2308-9-0x0000000000400000-0x0000000000509000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

MD5 8f221f63a4b89072b185fd5c0c0db853
SHA1 c13d25faf4c60a435ed2984a5336abf9afb1e351
SHA256 f03de23203170f559ed5427435a3684a17166fa1f1df31bfa16b34935acc4a22
SHA512 983d2c86f6975f2166bfb2bd0d0785bd02b1f18fccfaf9fe72cbf27fa26b2db205fcc8bbbf2371787264f67d3585d8403d9f9353eeabddb679512f0bd8eb6656

\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

MD5 5fa4a7916def4bc9c1d11c63ef4896a7
SHA1 f294789c7fc64eebf552838a8aed837d335fd236
SHA256 156b0deb3ab0bf545b6847fbacb2a6e1f6bfc00616b6f165ce3e2a4330c15210
SHA512 f9946ff838f32987d9b84eb66fd92a6bce12b868aabf77f896b7ee360805c143ddbd643cc92de9ce1aae9072d5803bf47b48c7c8335ab0427692e3adc35d43ab

memory/2744-38-0x0000000000E10000-0x0000000000E2A000-memory.dmp

memory/2744-39-0x0000000000E40000-0x0000000000E58000-memory.dmp

memory/2744-61-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-67-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-65-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-63-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-59-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-58-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-55-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-53-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-51-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-50-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-47-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-45-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-44-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-41-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2744-40-0x0000000000E40000-0x0000000000E52000-memory.dmp

memory/2308-68-0x0000000002260000-0x0000000002366000-memory.dmp

memory/2308-70-0x0000000000400000-0x0000000000509000-memory.dmp

memory/2308-69-0x0000000000400000-0x00000000008E0000-memory.dmp

memory/2744-71-0x0000000000400000-0x0000000000803000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

MD5 bb0616de76770a360d2952b1c7d57d7f
SHA1 1e55af5e66a576a34ef55f0ed7b033101c284883
SHA256 8ca7664fe8080deb4be556ceda8d7df7f48edaa6acd31ebe9ee8e0ae64c4e39c
SHA512 dc486d43808fd3492a34ea2172faeb67be096b1bc79b667108f96fcf6cddd628b244ece608c1d3caceea58dacf1f40ce6435913600bb0e59babcc47541e65d5b

memory/2880-82-0x0000000000E90000-0x0000000000ECC000-memory.dmp

memory/2880-83-0x0000000000ED0000-0x0000000000F0A000-memory.dmp

memory/2880-84-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-85-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-87-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-89-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-91-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-93-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-95-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-97-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-99-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-116-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-101-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-113-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-111-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-109-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-107-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-105-0x0000000000ED0000-0x0000000000F05000-memory.dmp

memory/2880-103-0x0000000000ED0000-0x0000000000F05000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-10 00:55

Reported

2024-11-10 00:57

Platform

win10v2004-20241007-en

Max time kernel

142s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1716 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 1716 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 1716 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe
PID 1876 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 1876 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 1876 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe
PID 4056 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 4056 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 4056 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe
PID 4056 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 4056 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe
PID 4056 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe

"C:\Users\Admin\AppData\Local\Temp\b077bcba4dace6e09744e52bab9c95885af60504047be67e282ee8ecf615fe3d.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp

Files

memory/1716-1-0x0000000002580000-0x000000000268C000-memory.dmp

memory/1716-2-0x0000000002690000-0x0000000002796000-memory.dmp

memory/1716-3-0x0000000000400000-0x0000000000509000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gE166412.exe

MD5 c6335c0a2c1ff34926e5059187fea778
SHA1 47ba414bcea12df8297a1b1a518ab48af68d6a73
SHA256 b60defc60d5c20848132dea613d554a165e7ffe18281d553d43e8669874e3d25
SHA512 ff7ad4f0ab4ad74e43545ff12de51014efc0f89a409dc0ab2eed0e2b40f3c3bbe94c78aa43a6f5f26f72c7ec0dae3ba90d77f94b961d6d2d7671880c042af058

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yx563456.exe

MD5 8f221f63a4b89072b185fd5c0c0db853
SHA1 c13d25faf4c60a435ed2984a5336abf9afb1e351
SHA256 f03de23203170f559ed5427435a3684a17166fa1f1df31bfa16b34935acc4a22
SHA512 983d2c86f6975f2166bfb2bd0d0785bd02b1f18fccfaf9fe72cbf27fa26b2db205fcc8bbbf2371787264f67d3585d8403d9f9353eeabddb679512f0bd8eb6656

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\161965264.exe

MD5 5fa4a7916def4bc9c1d11c63ef4896a7
SHA1 f294789c7fc64eebf552838a8aed837d335fd236
SHA256 156b0deb3ab0bf545b6847fbacb2a6e1f6bfc00616b6f165ce3e2a4330c15210
SHA512 f9946ff838f32987d9b84eb66fd92a6bce12b868aabf77f896b7ee360805c143ddbd643cc92de9ce1aae9072d5803bf47b48c7c8335ab0427692e3adc35d43ab

memory/3604-26-0x0000000000400000-0x0000000000803000-memory.dmp

memory/3604-27-0x0000000000400000-0x0000000000803000-memory.dmp

memory/3604-28-0x00000000026E0000-0x00000000026FA000-memory.dmp

memory/3604-29-0x0000000004E40000-0x00000000053E4000-memory.dmp

memory/3604-30-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

memory/3604-40-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-58-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-56-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-54-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-52-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-50-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-48-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-46-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-44-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-42-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-38-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-36-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-34-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-32-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/3604-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1716-59-0x0000000002580000-0x000000000268C000-memory.dmp

memory/1716-60-0x0000000002690000-0x0000000002796000-memory.dmp

memory/1716-61-0x0000000000400000-0x0000000000509000-memory.dmp

memory/1716-62-0x0000000000400000-0x00000000008E0000-memory.dmp

memory/3604-66-0x0000000000400000-0x0000000000803000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\247750528.exe

MD5 bb0616de76770a360d2952b1c7d57d7f
SHA1 1e55af5e66a576a34ef55f0ed7b033101c284883
SHA256 8ca7664fe8080deb4be556ceda8d7df7f48edaa6acd31ebe9ee8e0ae64c4e39c
SHA512 dc486d43808fd3492a34ea2172faeb67be096b1bc79b667108f96fcf6cddd628b244ece608c1d3caceea58dacf1f40ce6435913600bb0e59babcc47541e65d5b

memory/1904-71-0x00000000024E0000-0x000000000251C000-memory.dmp

memory/1904-72-0x0000000005420000-0x000000000545A000-memory.dmp

memory/1904-86-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-84-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-104-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-102-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-100-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-98-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-96-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-94-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-90-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-89-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-83-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-81-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-78-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-92-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-76-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-74-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-73-0x0000000005420000-0x0000000005455000-memory.dmp

memory/1904-865-0x0000000007920000-0x0000000007F38000-memory.dmp

memory/1904-866-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

memory/1904-867-0x0000000007FC0000-0x00000000080CA000-memory.dmp

memory/1904-868-0x00000000080E0000-0x000000000811C000-memory.dmp

memory/1904-869-0x00000000027A0000-0x00000000027EC000-memory.dmp