healer | 46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe
Size

652KB
MD5

14a97fee99c8fced60e9cad2584f4aa7
SHA1

f4d706194ffa5e91058aa1fbc391557f2fba0dca
SHA256

46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83
SHA512

5dc88fef231ff426ad5b8c1c0fdf965f5d01e293ef448745bfde09e182bd04b76d51c85d736405e625a5426157638464dbcf27b844aab5d8d5fe0113614ac95e
SSDEEP

12288:xMr7y90STdMwnLHu/oaTJfEniBrTVPs5RVtCEGKlVMA5g:2ybSwLHuRhPo0uQb

Score

10^/10

healer redline diza norm dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023227-13.dat	healer
behavioral1/memory/3580-14-0x0000000000170000-0x000000000017A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr484884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr484884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr484884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr484884.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr484884.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr484884.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2384-2111-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
behavioral1/files/0x000700000002322a-2117.dat	family_redline
behavioral1/memory/4920-2125-0x0000000000910000-0x0000000000940000-memory.dmp	family_redline
behavioral1/files/0x0007000000023225-2139.dat	family_redline
behavioral1/memory/4068-2141-0x0000000000E00000-0x0000000000E2E000-memory.dmp	family_redline

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023227-13.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3580-14-0x0000000000170000-0x000000000017A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with ConfuserEx Mod 5 IoCs

resource	yara_rule
behavioral1/memory/2384-2111-0x0000000005400000-0x0000000005432000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx
behavioral1/files/0x000700000002322a-2117.dat	INDICATOR_EXE_Packed_ConfuserEx
behavioral1/memory/4920-2125-0x0000000000910000-0x0000000000940000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx
behavioral1/files/0x0007000000023225-2139.dat	INDICATOR_EXE_Packed_ConfuserEx
behavioral1/memory/4068-2141-0x0000000000E00000-0x0000000000E2E000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	ku722878.exe

Executes dropped EXE 5 IoCs

pid	Process
4524	zivy7303.exe
3580	jr484884.exe
2384	ku722878.exe
4920	1.exe
4068	lr379668.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr484884.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zivy7303.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3232	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	2384	WerFault.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3580	jr484884.exe
3580	jr484884.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3580	jr484884.exe
Token: SeDebugPrivilege	2384	ku722878.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4524	3252	46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe	86
PID 3252 wrote to memory of 4524	3252	46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe	86
PID 3252 wrote to memory of 4524	3252	46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe	86
PID 4524 wrote to memory of 3580	4524	zivy7303.exe	87
PID 4524 wrote to memory of 3580	4524	zivy7303.exe	87
PID 4524 wrote to memory of 2384	4524	zivy7303.exe	96
PID 4524 wrote to memory of 2384	4524	zivy7303.exe	96
PID 4524 wrote to memory of 2384	4524	zivy7303.exe	96
PID 2384 wrote to memory of 4920	2384	ku722878.exe	97
PID 2384 wrote to memory of 4920	2384	ku722878.exe	97
PID 2384 wrote to memory of 4920	2384	ku722878.exe	97
PID 3252 wrote to memory of 4068	3252	46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe	101
PID 3252 wrote to memory of 4068	3252	46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe	101
PID 3252 wrote to memory of 4068	3252	46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe	101

C:\Users\Admin\AppData\Local\Temp\46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe
"C:\Users\Admin\AppData\Local\Temp\46e9c10bc32dd04b8ef9fadb99eca630e3d47eedc0165516b858bb7856da5e83.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivy7303.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivy7303.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr484884.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr484884.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku722878.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku722878.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      PID:4920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1380
      4⤵
      Program crash
      PID:4596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr379668.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr379668.exe
  2⤵
  - Executes dropped EXE
  PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2384 -ip 2384
1⤵
PID:536

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr379668.exe

Filesize
169KB

MD5
502bbe4f68566db8ffe8acdf61eb0eb6

SHA1
7745a2d21b789b35fbf593f24393de9008d0df30

SHA256
8885442da8a77ae5076de07d7dc9c25b37bb56d1218784df7ac67a15f0501b36

SHA512
5760bcac134d65030afeda8ab0c6da89b4795c4bacf60fac8975816e541fb2f2029ed84fad49f0297a7107de0717f27ade00520a56b15ad2cb69e16d4c3a28a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivy7303.exe

Filesize
498KB

MD5
31a7711093ab1c92e1d599d54b2984d6

SHA1
309f9e8848b01fe7229d8a6e069cf56de426f910

SHA256
d083160fa2ed9c5037806fe50d4e467431cb83ab1157830a3357194232d98b3c

SHA512
4a6cad337cad6cb444d5584a3e95cd163f9eb16b2de75e0a776bad39d674983bcb07753d99cdab1b2f63576e44d3c01eb43e8a930331d54a992c56be7f47a9d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr484884.exe

Filesize
12KB

MD5
73ca7d6c3646363d5e0f8d94c5f063e1

SHA1
7c2342ed0ff6edf7bc2ff6148e4874d0300b37bf

SHA256
ab985a683058ef9d9c10c311592f16c2ebfaa3dbb54b973ba0f8eb9921662822

SHA512
98412a9f7b84bdb937d07b6a44a9695f351a15301d1ad708b79df907cac93f64ab752edec4007706fd0c3f20ddc0dbcbfc233c4d68edce2eca530190a4f78743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku722878.exe

Filesize
417KB

MD5
bf60d846ae7c73d56be7f3c06ef04541

SHA1
851585e4e481326a527c70d70bec57750c14c6d8

SHA256
7db8da80b25d1ae6ce7bf0df261f1ef969e081775bec905eafbaa57fcb40b687

SHA512
5ff2e59ba3f0f4ba748f27164f3fbf2bf7ee752ed584a68a6854d57d3beef784ae5772570b727f79fc386da9cf3b688145617e30c1ff47ccf9b02d40ab19d7b1

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2384-76-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-40-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-25-0x0000000002440000-0x00000000024A6000-memory.dmp

Filesize
408KB

Download
memory/2384-26-0x0000000073AF0000-0x00000000742A0000-memory.dmp

Filesize
7.7MB

Download
memory/2384-27-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/2384-28-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/2384-29-0x0000000004CC0000-0x0000000005264000-memory.dmp

Filesize
5.6MB

Download
memory/2384-78-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-31-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-32-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-34-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-36-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-38-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-80-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-42-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-44-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-46-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-82-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-50-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-52-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-54-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-56-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-58-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-60-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-62-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-64-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-66-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-68-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-70-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-72-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-74-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-23-0x0000000001EC0000-0x0000000001F1B000-memory.dmp

Filesize
364KB

Download
memory/2384-30-0x0000000004C00000-0x0000000004C66000-memory.dmp

Filesize
408KB

Download
memory/2384-24-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/2384-48-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-84-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-86-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-88-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-90-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-92-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-94-0x0000000004C00000-0x0000000004C5F000-memory.dmp

Filesize
380KB

Download
memory/2384-2111-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/2384-2112-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/2384-2130-0x0000000001EC0000-0x0000000001F1B000-memory.dmp

Filesize
364KB

Download
memory/2384-22-0x00000000004E0000-0x00000000005E0000-memory.dmp

Filesize
1024KB

Download
memory/2384-2137-0x0000000073AF0000-0x00000000742A0000-memory.dmp

Filesize
7.7MB

Download
memory/2384-2136-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download
memory/3580-17-0x00007FFB42560000-0x00007FFB43021000-memory.dmp

Filesize
10.8MB

Download
memory/3580-14-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/3580-15-0x00007FFB42560000-0x00007FFB43021000-memory.dmp

Filesize
10.8MB

Download
memory/4068-2141-0x0000000000E00000-0x0000000000E2E000-memory.dmp

Filesize
184KB

Download
memory/4068-2148-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4068-2147-0x0000000073AF0000-0x00000000742A0000-memory.dmp

Filesize
7.7MB

Download
memory/4068-2144-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4068-2143-0x0000000002FF0000-0x0000000002FF6000-memory.dmp

Filesize
24KB

Download
memory/4068-2142-0x0000000073AF0000-0x00000000742A0000-memory.dmp

Filesize
7.7MB

Download
memory/4920-2131-0x0000000005290000-0x00000000052A2000-memory.dmp

Filesize
72KB

Download
memory/4920-2128-0x00000000058B0000-0x0000000005EC8000-memory.dmp

Filesize
6.1MB

Download
memory/4920-2126-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download
memory/4920-2127-0x0000000073AF0000-0x00000000742A0000-memory.dmp

Filesize
7.7MB

Download
memory/4920-2134-0x0000000005340000-0x000000000538C000-memory.dmp

Filesize
304KB

Download
memory/4920-2133-0x00000000052F0000-0x000000000532C000-memory.dmp

Filesize
240KB

Download
memory/4920-2132-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/4920-2145-0x0000000073AF0000-0x00000000742A0000-memory.dmp

Filesize
7.7MB

Download
memory/4920-2146-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/4920-2125-0x0000000000910000-0x0000000000940000-memory.dmp

Filesize
192KB

Download
memory/4920-2129-0x00000000053A0000-0x00000000054AA000-memory.dmp

Filesize
1.0MB

Download