healer | 04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe
Size

660KB
MD5

378d2026f2b0b9832167f2c88828b0d9
SHA1

ddb96bb621d87d4ea9b8c866dfd83b4cf64be5fc
SHA256

04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224
SHA512

f4c3103e777038a4ffc10b2c723252486a06717dcda95d54ae7ae60d0f8750cfdd618c2bf427703a953b99e294daa370e310bbc2927a32b9266a4330756f707b
SSDEEP

12288:6MrPy90PC14kPf1+CMK7FZsYYmUbFk47oMhzaxs9sej4rDFKh4b:RyIaDtxYmckLWaxsau495b

Score

10^/10

healer redline dozt norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dozt

77.91.124.145:4125

Attributes

auth_value
857bdfe4fa14711025859d89f18b32cb

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023bdc-12.dat	healer
behavioral1/memory/4992-15-0x0000000000820000-0x000000000082A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr028981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr028981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr028981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr028981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr028981.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr028981.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1856-2105-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
behavioral1/files/0x0008000000023c0e-2109.dat	family_redline
behavioral1/memory/5940-2118-0x0000000000F40000-0x0000000000F70000-memory.dmp	family_redline
behavioral1/files/0x000e000000023bd7-2127.dat	family_redline
behavioral1/memory/3080-2129-0x0000000000960000-0x0000000000990000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	ku881751.exe

Executes dropped EXE 5 IoCs

pid	Process
116	ziHy9891.exe
4992	jr028981.exe
1856	ku881751.exe
5940	1.exe
3080	lr614688.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr028981.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziHy9891.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3668	1856	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziHy9891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku881751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr614688.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4992	jr028981.exe
4992	jr028981.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	jr028981.exe
Token: SeDebugPrivilege	1856	ku881751.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 116	4836	04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe	86
PID 4836 wrote to memory of 116	4836	04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe	86
PID 4836 wrote to memory of 116	4836	04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe	86
PID 116 wrote to memory of 4992	116	ziHy9891.exe	87
PID 116 wrote to memory of 4992	116	ziHy9891.exe	87
PID 116 wrote to memory of 1856	116	ziHy9891.exe	94
PID 116 wrote to memory of 1856	116	ziHy9891.exe	94
PID 116 wrote to memory of 1856	116	ziHy9891.exe	94
PID 1856 wrote to memory of 5940	1856	ku881751.exe	97
PID 1856 wrote to memory of 5940	1856	ku881751.exe	97
PID 1856 wrote to memory of 5940	1856	ku881751.exe	97
PID 4836 wrote to memory of 3080	4836	04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe	102
PID 4836 wrote to memory of 3080	4836	04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe	102
PID 4836 wrote to memory of 3080	4836	04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe	102

C:\Users\Admin\AppData\Local\Temp\04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe
"C:\Users\Admin\AppData\Local\Temp\04580b36fc34683cad05106c0ea5c337d64c9d1b49d77d8f2d4fa5666f9a0224.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHy9891.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHy9891.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr028981.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr028981.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku881751.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku881751.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1508
      4⤵
      Program crash
      PID:3668
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr614688.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr614688.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1856 -ip 1856
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr614688.exe

Filesize
169KB

MD5
f21d6663134b5a38377f9f5a20d1c28a

SHA1
1b69cd0f79fe0b11a4b3c1b8e2b900e8b4d6b9dc

SHA256
8a8c2028a1162b48ef779861a755d201fb63cc2c4daf89f3ffc04b72ad4e9ce5

SHA512
c32a024b4ca88461fc44ede82e100d7bc57ae2306729b4b6a46b289c8f581d9f6d1b53538b74982ff97ca102e5f3e5dd900827008c7b79fc5f77858e12951073

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHy9891.exe

Filesize
506KB

MD5
9afcd315555af981b5d94c5022c9f0e7

SHA1
0b43eb191a1510a9c2f55f6a1070b4aef36cbf92

SHA256
cf46255ce446bb3a21c8dc547cac51b35ede38d02844cb5a6fe8061443041ed7

SHA512
d85fe2f8a8f68a213211808e8d497cd71fbad1db7082927a6a9c186ec3db41018184be29ba8d11d12d05843f9ba65c83f73c4a43f9b11c04b0230578f53847f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr028981.exe

Filesize
13KB

MD5
582c4c363c7d039a7708443ad94a6dda

SHA1
ff3398d82146f8671be007f5c7cbf1830ee46754

SHA256
67b494f41908f90aecdf67cb0e8280152173e01b0f22527e8b3ae75b507ecc19

SHA512
63d512d48866412bc5a87ba28faa63aaf37c3f4cd78f837f5686174be480702e00773427115ab03c532946bbec82ce21fc1dafe34dcb99dea2384410f030d1d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku881751.exe

Filesize
426KB

MD5
d5e743d6729af87fbf81830a92def4fe

SHA1
e713880ca8485fdf49f1746f384c7e25eed5a37c

SHA256
2f837e599a43a8e50bbdc5aa2a5d7fb89a69f147ffae280ebd7a1c2aeecce4c9

SHA512
60f2e6672302388505d0f0ed2cf7db189dc70af3e70ce6e5eaa93749b4ba1a50ec57c58ca8a7f6a889af669c134f21182476cda39e4da2366b780357543fb20b

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1856-54-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-88-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-24-0x00000000051B0000-0x0000000005216000-memory.dmp

Filesize
408KB

Download
memory/1856-28-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-42-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-64-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-44-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-86-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-84-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-82-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-80-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-38-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-76-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-74-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-72-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-70-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-68-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-66-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-60-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-58-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-47-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-22-0x0000000004B50000-0x0000000004BB6000-memory.dmp

Filesize
408KB

Download
memory/1856-52-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-50-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-56-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-23-0x0000000004BC0000-0x0000000005164000-memory.dmp

Filesize
5.6MB

Download
memory/1856-78-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-62-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-36-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-34-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-32-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-48-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-30-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-26-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-25-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-40-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/1856-2105-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/3080-2129-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/3080-2130-0x0000000002AC0000-0x0000000002AC6000-memory.dmp

Filesize
24KB

Download
memory/4992-14-0x00007FFEF5893000-0x00007FFEF5895000-memory.dmp

Filesize
8KB

Download
memory/4992-15-0x0000000000820000-0x000000000082A000-memory.dmp

Filesize
40KB

Download
memory/4992-16-0x00007FFEF5893000-0x00007FFEF5895000-memory.dmp

Filesize
8KB

Download
memory/5940-2118-0x0000000000F40000-0x0000000000F70000-memory.dmp

Filesize
192KB

Download
memory/5940-2119-0x0000000005720000-0x0000000005726000-memory.dmp

Filesize
24KB

Download
memory/5940-2120-0x0000000005E70000-0x0000000006488000-memory.dmp

Filesize
6.1MB

Download
memory/5940-2121-0x0000000005990000-0x0000000005A9A000-memory.dmp

Filesize
1.0MB

Download
memory/5940-2122-0x00000000058C0000-0x00000000058D2000-memory.dmp

Filesize
72KB

Download
memory/5940-2123-0x0000000005920000-0x000000000595C000-memory.dmp

Filesize
240KB

Download
memory/5940-2124-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

Filesize
304KB

Download