Malware Analysis Report

2025-08-10 14:35

Sample ID 241111-gq48xsxpgn
Target f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9
SHA256 f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9
Tags
healer redline discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9

Threat Level: Known bad

The file f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9 was found to be: Known bad.

Malicious Activity Summary

healer redline discovery dropper evasion infostealer persistence trojan

Detects Healer an antivirus disabler dropper

RedLine payload

Healer

Modifies Windows Defender Real-time Protection settings

Redline family

Healer family

RedLine

Executes dropped EXE

Windows security modification

Adds Run key to start application

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-11 06:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-11 06:01

Reported

2024-11-11 06:04

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4888 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe
PID 4888 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe
PID 4888 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe
PID 4008 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe
PID 4008 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe
PID 4008 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe
PID 4008 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe
PID 4008 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe
PID 4008 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe

"C:\Users\Admin\AppData\Local\Temp\f967e7c5ec1bb30ac85985c642436844bdace9ad7a7301fccb7ebefc337688e9.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
RU 185.161.248.143:38452 tcp
SE 192.229.221.95:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un084675.exe

MD5 98d6d63d33b7068bb82d7b467b8e8e9b
SHA1 ac7bf450d77157413aa185b198cbad7f55b709d0
SHA256 04eb1a69cb2ac63ce2e0d9a0e119b683f109e3b2d75aa59edb3ad03790d50f66
SHA512 9484c7680cfc8cd4dbe296864d42dbee9e564f5512388120eb84f6a41bb5acc2b73a49959dee02c7c3c3c4116052b187bf262c08fa7dc5189b7985c7fb2bd962

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\30714751.exe

MD5 c9a968a7fd8c3153a04c79e05d53dc4e
SHA1 ca727a66c32b9c2bf95d52d2404179df122af2e1
SHA256 9d9bb0c8c3e93b35eb7d5b3ef47d663ba906e37ba372b366d976042b807ac31f
SHA512 36204dbc4d5429402d92ec10defb72ad7c59ef87a3dd1a720e743b7d46582cd6f555b4003927068228d50822ac205fa60f900c087e240184a9de2a84d3958d04

memory/1064-15-0x0000000000990000-0x0000000000A90000-memory.dmp

memory/1064-16-0x00000000008E0000-0x000000000090D000-memory.dmp

memory/1064-17-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1064-18-0x0000000000400000-0x0000000000803000-memory.dmp

memory/1064-19-0x00000000027D0000-0x00000000027EA000-memory.dmp

memory/1064-20-0x0000000004E70000-0x0000000005414000-memory.dmp

memory/1064-21-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

memory/1064-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-47-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-40-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-27-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-25-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-23-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-22-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

memory/1064-50-0x0000000000990000-0x0000000000A90000-memory.dmp

memory/1064-51-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1064-55-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1064-54-0x0000000000400000-0x0000000000803000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk634448.exe

MD5 e79e5f1f45bd4f426b0884c66131314e
SHA1 419ee6311eb558eb44923e82dfbcefcbfc4ea1f0
SHA256 157f165ab8fe9936f6c6ad9d54c6b3a436976f1a0ca12baf108f9c82f8f0af6e
SHA512 3a765a5939d1f38751b9b7221522824d3b5461182a3c5e3e1b10389e2b31cd306e7d72a83a2d2b8693ea8047a9148c17f490b8521e7d0378cf34679f94117008

memory/2388-60-0x0000000002910000-0x000000000294C000-memory.dmp

memory/2388-61-0x00000000053F0000-0x000000000542A000-memory.dmp

memory/2388-71-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-69-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-67-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-65-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-63-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-62-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-89-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-95-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-93-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-92-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-87-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-85-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-83-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-81-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-79-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-77-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-75-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-73-0x00000000053F0000-0x0000000005425000-memory.dmp

memory/2388-854-0x00000000078F0000-0x0000000007F08000-memory.dmp

memory/2388-855-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

memory/2388-856-0x0000000007FC0000-0x00000000080CA000-memory.dmp

memory/2388-857-0x00000000080E0000-0x000000000811C000-memory.dmp

memory/2388-858-0x00000000023C0000-0x000000000240C000-memory.dmp