healer | b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13.exe
Size

936KB
MD5

27cafab4718a15b81c29330865bae757
SHA1

f24a3a4496a5bb52fd862fd53548f0910dae0b12
SHA256

b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13
SHA512

5b5a941376425830641dcc08d3e9bd7854af13fa7db768bb8d8c9f446df4c8c241c3579983eed9cee5738955f0c4628379b304297f1f35be54c3b61e600a977b
SSDEEP

12288:my90JG9Q5e1yRf4ZWyY4BpgnWDN6PCv9BI9gnMT3kGFX58g+ZvvbrtkkQuZY1Ksr:myQ5fCnYnWwG3IOncxX58zjrVY1br

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b89-19.dat	healer
behavioral1/memory/2604-22-0x0000000000AC0000-0x0000000000ACA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it653505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it653505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it653505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it653505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it653505.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it653505.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/1612-29-0x0000000002740000-0x000000000277C000-memory.dmp	family_redline
behavioral1/memory/1612-31-0x00000000053E0000-0x000000000541A000-memory.dmp	family_redline
behavioral1/memory/1612-43-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-45-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-95-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-93-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-91-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-89-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-87-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-85-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-81-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-79-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-77-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-75-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-73-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-69-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-67-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-65-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-63-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-61-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-59-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-56-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-53-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-51-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-49-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-47-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-41-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-39-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-83-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-71-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-58-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-37-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-35-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-33-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline
behavioral1/memory/1612-32-0x00000000053E0000-0x0000000005415000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
5088	zijf7309.exe
3152	zicm9002.exe
2604	it653505.exe
1612	jr402676.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it653505.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zijf7309.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zicm9002.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zijf7309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zicm9002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jr402676.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2604	it653505.exe
2604	it653505.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	it653505.exe
Token: SeDebugPrivilege	1612	jr402676.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 5088	1088	b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13.exe	86
PID 1088 wrote to memory of 5088	1088	b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13.exe	86
PID 1088 wrote to memory of 5088	1088	b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13.exe	86
PID 5088 wrote to memory of 3152	5088	zijf7309.exe	87
PID 5088 wrote to memory of 3152	5088	zijf7309.exe	87
PID 5088 wrote to memory of 3152	5088	zijf7309.exe	87
PID 3152 wrote to memory of 2604	3152	zicm9002.exe	88
PID 3152 wrote to memory of 2604	3152	zicm9002.exe	88
PID 3152 wrote to memory of 1612	3152	zicm9002.exe	96
PID 3152 wrote to memory of 1612	3152	zicm9002.exe	96
PID 3152 wrote to memory of 1612	3152	zicm9002.exe	96

C:\Users\Admin\AppData\Local\Temp\b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13.exe
"C:\Users\Admin\AppData\Local\Temp\b363e80e09c44e1060a6aca1b75033503d07c6f786a02368182e3c7f26226f13.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijf7309.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijf7309.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zicm9002.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zicm9002.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it653505.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it653505.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr402676.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr402676.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijf7309.exe

Filesize
623KB

MD5
5b0a33365edf265a69dd3256b641511c

SHA1
289797d0639b150a3bfc2424a508ef546e726441

SHA256
020026ec07904f32547940527b78fc48b57d800f08bdfaed44d19e7bf69f50e6

SHA512
a76193a1079b8b2cdaafbe7b5d821a3184ead1a6c3c5148fbf988024b93d20a47b3ebdcdd9a454e5b5df12c5048f42b364f7cf033f36fe8269a330e4c8dc85d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zicm9002.exe

Filesize
468KB

MD5
52eda0e5695c43435a7101f56ba9b960

SHA1
23102225705508a22a88c2175a9f4d4e30b62594

SHA256
ffbff9e71876b46da584589b98eb25d4594f44b294459550027222baeb0143d3

SHA512
85c3286ea1f06bfbe1b8e1223154f64ceb05437de15f0f929c9c100209c5ecb5a0522ee817dccdb9a6be74da19f74c86fa8c9bb01f8216c9364ecf78619aa2c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it653505.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr402676.exe

Filesize
488KB

MD5
396021759c818afc2d6781a245a218cd

SHA1
6e772e41fb1578218a5bf4caa32ff25eae3f5f24

SHA256
17c99af4210e35fe6e10e1e1011420f602b81be9368407230af01a3a7ae2a1a7

SHA512
32af6e6f92e5e47b93285741fea22c1f7ccd0dccd7dcc92c344feefbac5f7c1f86dceb2f43383acb760de9b3dfe23165008be801b1ee04201f20657213f5de1d

Download Submit
memory/1612-67-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-29-0x0000000002740000-0x000000000277C000-memory.dmp

Filesize
240KB

Download
memory/1612-828-0x00000000027D0000-0x000000000281C000-memory.dmp

Filesize
304KB

Download
memory/1612-65-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-30-0x0000000004DF0000-0x0000000005394000-memory.dmp

Filesize
5.6MB

Download
memory/1612-31-0x00000000053E0000-0x000000000541A000-memory.dmp

Filesize
232KB

Download
memory/1612-43-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-45-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-95-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-93-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-827-0x00000000080E0000-0x000000000811C000-memory.dmp

Filesize
240KB

Download
memory/1612-89-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-63-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-85-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-81-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-79-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-77-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-75-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-73-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-69-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-91-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-826-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/1612-87-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-61-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-59-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-56-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-53-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-51-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-49-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-47-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-41-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-39-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-83-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-71-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-58-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-37-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-35-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-33-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-32-0x00000000053E0000-0x0000000005415000-memory.dmp

Filesize
212KB

Download
memory/1612-824-0x00000000078E0000-0x0000000007EF8000-memory.dmp

Filesize
6.1MB

Download
memory/1612-825-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/2604-24-0x00007FFDCEBD3000-0x00007FFDCEBD5000-memory.dmp

Filesize
8KB

Download
memory/2604-21-0x00007FFDCEBD3000-0x00007FFDCEBD5000-memory.dmp

Filesize
8KB

Download
memory/2604-22-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

Filesize
40KB

Download