Malware Analysis Report

2024-11-30 23:17

Sample ID 241113-gfewaaxcjk
Target 6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe
SHA256 6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578a
Tags
healer redline rodik discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578a

Threat Level: Known bad

The file 6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe was found to be: Known bad.

Malicious Activity Summary

healer redline rodik discovery dropper evasion infostealer persistence trojan

Detects Healer an antivirus disabler dropper

RedLine payload

Redline family

Healer

RedLine

Modifies Windows Defender Real-time Protection settings

Healer family

Windows security modification

Executes dropped EXE

Adds Run key to start application

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 05:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 05:44

Reported

2024-11-13 05:46

Platform

win10v2004-20241007-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe"

Signatures

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kEk39Xb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kEk39Xb.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3572 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe
PID 3572 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe
PID 3572 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe
PID 2800 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe
PID 2800 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe
PID 2800 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe
PID 3952 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe
PID 3952 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe
PID 3952 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe
PID 1068 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe
PID 1068 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe
PID 1068 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kEk39Xb.exe
PID 1068 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kEk39Xb.exe
PID 1068 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kEk39Xb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe

"C:\Users\Admin\AppData\Local\Temp\6d6ac451b01656650a855a8924200216a44cca64917f9ac82da0a4af529c578aN.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kEk39Xb.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kEk39Xb.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 193.233.20.23:4124 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
RU 193.233.20.23:4124 tcp
RU 193.233.20.23:4124 tcp
RU 193.233.20.23:4124 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
RU 193.233.20.23:4124 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sXR83Hm47.exe

MD5 fd45babeea7abb4d13e4e671286b4c2b
SHA1 9b4d8ecc064ac9394dcd476f89b0412c91beecce
SHA256 aaa6d26f568f9b19c446a82e53760d352fa9613b25203f0d9722f4c03a7b5133
SHA512 c7a187b8cc9edc1eca9c8647ab43ce7294dcc90171bc7dd18992849a7f4b7a51dcf0a82e95dd8df73bf87a897eb1d7558cb4461cf5b733f6873280d65938cc6e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxB62Yf17.exe

MD5 58aaeeb0b59d1acd15bd88dd2c3196e0
SHA1 076d240ec26243c6204f88959a7e6d367aeb30b2
SHA256 44779cc1ca900e864d2b20c004d8785e3107828af7e9d8c35cae596cf9103d97
SHA512 405b5f08e21b773659c2a4143f270c6b6ae221b77775712b04b9426e9218d8089a86b67884bb2eb524ad74f8cdbdc0929ebf05b5db65102c2779f9d786ce552e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\suC42DU94.exe

MD5 51a718e584b06193e03f980bafbf7eda
SHA1 a396f841e51bd0030c19dfb64a584c93866154ac
SHA256 678b0557f7d36469a59cd6f8b7cd40ee6cd59da92441c01799cf2e8b6f38ac2a
SHA512 7a94083fcf494ad5869d06da9b5e78771594dcb59b862aa24ee6a05be2f1f37db5b572f8599a33bc6dffaa1364c6f2c043fd36cf83d1ac287a056139e559f49f

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\iDK84GF.exe

MD5 f061ffc02a0f4bbcb07725b34547d624
SHA1 48f160581b0279f1b30c09591c344556e5fa4116
SHA256 9c8936c0b0965a7269ebb525dcdfb1b3d30c3d5ff3a6aea102f57f59ddcf9e43
SHA512 4cdc7122165211cbab2fb7b021e2a002248d38c36777d54fa2b9fac81d5635f4330145dabb8ea9643ecd4a9b2286d817cb4f8a272b2bb3a0f8fa2a8a2be65fd2

memory/4756-28-0x00000000006C0000-0x00000000006CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kEk39Xb.exe

MD5 b0b94e2c2b7fcb269bf95b62cc9b065b
SHA1 538d87b1ccae12796ed59ee2b407a5e19fce17ed
SHA256 b99491d4afd199d95ff54c83be16a8e91f7a25299ac3b592e0e563b7798dd578
SHA512 ee8c0a033e9decaae0f9de9e67907feca5de84f3ef300e34e8de8871bf37fe1d21b4e1922c1989cece049e988aa2c1410953a1951277466daf572723e4c42b25

memory/3156-34-0x0000000004BB0000-0x0000000004BF6000-memory.dmp

memory/3156-35-0x0000000007400000-0x00000000079A4000-memory.dmp

memory/3156-36-0x0000000004D50000-0x0000000004D94000-memory.dmp

memory/3156-48-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-50-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-98-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-96-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-94-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-92-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-90-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-88-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-86-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-82-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-80-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-78-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-76-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-74-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-72-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-70-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-68-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-66-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-62-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-60-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-58-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-56-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-54-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-46-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-44-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-42-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-100-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-84-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-64-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-52-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-40-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-38-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-37-0x0000000004D50000-0x0000000004D8F000-memory.dmp

memory/3156-943-0x00000000079B0000-0x0000000007FC8000-memory.dmp

memory/3156-944-0x00000000072A0000-0x00000000073AA000-memory.dmp

memory/3156-945-0x0000000007FD0000-0x0000000007FE2000-memory.dmp

memory/3156-946-0x0000000007FF0000-0x000000000802C000-memory.dmp

memory/3156-947-0x0000000008130000-0x000000000817C000-memory.dmp