healer | 0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe
Size

690KB
MD5

34d8717e57e1e30d1d72c07eef65ddfe
SHA1

cbdf2e972a0dd5d9225fd404a70b1b6264fbceff
SHA256

0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00
SHA512

8e753a5219c153eba5e7369da3ef98a1f0a47edddb3d96cfef7b4f73e96de665927440c4f93cbcf6e1a40b4fc66531a3547c744bd0c7a081bd8726fc883807ce
SSDEEP

12288:xUlkXVb1OMBbwB+Pw2Bt3D46kp1j40d8CHYEW1jKGw2T/UVmVFcM:xUmrOMBo7etT4pjf8CHYEW1ji2T8Vg

Score

10^/10

healer redline down discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016bfc-18.dat	healer
behavioral1/memory/3028-23-0x0000000000CE0000-0x0000000000CEA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr194876.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr194876.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr194876.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr194876.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr194876.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr194876.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 34 IoCs

resource	yara_rule
behavioral1/memory/2748-39-0x0000000002850000-0x0000000002896000-memory.dmp	family_redline
behavioral1/memory/2748-40-0x0000000002890000-0x00000000028D4000-memory.dmp	family_redline
behavioral1/memory/2748-41-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-42-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-70-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-44-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-46-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-48-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-90-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-50-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-52-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-54-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-56-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-58-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-60-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-62-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-64-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-66-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-76-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-96-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-102-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-100-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-98-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-94-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-92-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-88-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-86-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-84-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-82-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-80-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-78-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-74-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-72-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline
behavioral1/memory/2748-68-0x0000000002890000-0x00000000028CE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2528	zilH1185.exe
3028	jr194876.exe
2748	ku843123.exe

Loads dropped DLL 6 IoCs

pid	Process
2212	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe
2528	zilH1185.exe
2528	zilH1185.exe
2528	zilH1185.exe
2528	zilH1185.exe
2748	ku843123.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	jr194876.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr194876.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zilH1185.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zilH1185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku843123.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	jr194876.exe
3028	jr194876.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	jr194876.exe
Token: SeDebugPrivilege	2748	ku843123.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2528	2212	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe	30
PID 2212 wrote to memory of 2528	2212	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe	30
PID 2212 wrote to memory of 2528	2212	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe	30
PID 2212 wrote to memory of 2528	2212	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe	30
PID 2212 wrote to memory of 2528	2212	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe	30
PID 2212 wrote to memory of 2528	2212	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe	30
PID 2212 wrote to memory of 2528	2212	0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe	30
PID 2528 wrote to memory of 3028	2528	zilH1185.exe	31
PID 2528 wrote to memory of 3028	2528	zilH1185.exe	31
PID 2528 wrote to memory of 3028	2528	zilH1185.exe	31
PID 2528 wrote to memory of 3028	2528	zilH1185.exe	31
PID 2528 wrote to memory of 3028	2528	zilH1185.exe	31
PID 2528 wrote to memory of 3028	2528	zilH1185.exe	31
PID 2528 wrote to memory of 3028	2528	zilH1185.exe	31
PID 2528 wrote to memory of 2748	2528	zilH1185.exe	33
PID 2528 wrote to memory of 2748	2528	zilH1185.exe	33
PID 2528 wrote to memory of 2748	2528	zilH1185.exe	33
PID 2528 wrote to memory of 2748	2528	zilH1185.exe	33
PID 2528 wrote to memory of 2748	2528	zilH1185.exe	33
PID 2528 wrote to memory of 2748	2528	zilH1185.exe	33
PID 2528 wrote to memory of 2748	2528	zilH1185.exe	33

C:\Users\Admin\AppData\Local\Temp\0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe
"C:\Users\Admin\AppData\Local\Temp\0796df4bfce5301646910613d9aba70f9a811304eb94e61534054ca837dd2e00.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\zilH1185.exe

Filesize
404KB

MD5
fc26679ca223c30d775882fc2fd4ced4

SHA1
e26c8a65b3a6c0b52a88876f6cae0bf3bf806f6b

SHA256
6c34804ae1fb2383ce034c8a68be5bb16984c3aa5638f25ba50ab9111eea1b32

SHA512
dd8f3e2840220662794bdd3342c2e6d1cb63b08bfc36fd4066ff0a6e13a0ee8dd633271891ec36805d4d4f9f4fc31a3829fe5e8eddb5d7ebdabd557179202c90

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr194876.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku843123.exe

Filesize
358KB

MD5
ccef72544333fb6d240d7834c6529657

SHA1
4598184479cc118f51717408313b47d146c66443

SHA256
5e0cdfa2cd6aeb1b3d3e6f41296227ea63449dea84439f42db0ff32383c05782

SHA512
d889137ab8d1f242dbac3815c33b7509681327aa93b381cbdd894d722ae1b625c7c4e6adb0c13c4f099d85ca95f5c5f82c06a3b72f954f969fb2c88370307564

Download Submit
memory/2212-27-0x0000000000400000-0x000000000076F000-memory.dmp

Filesize
3.4MB

Download
memory/2212-1-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2212-2-0x0000000000360000-0x00000000003EA000-memory.dmp

Filesize
552KB

Download
memory/2212-3-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2212-0-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2212-24-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2212-25-0x0000000000360000-0x00000000003EA000-memory.dmp

Filesize
552KB

Download
memory/2212-26-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2748-52-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-64-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-68-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-39-0x0000000002850000-0x0000000002896000-memory.dmp

Filesize
280KB

Download
memory/2748-40-0x0000000002890000-0x00000000028D4000-memory.dmp

Filesize
272KB

Download
memory/2748-41-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-42-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-70-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-44-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-46-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-48-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-90-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-50-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-72-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-54-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-56-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-58-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-60-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-62-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-74-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-66-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-76-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-96-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-102-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-100-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-98-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-94-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-92-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-88-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-86-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-84-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-82-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-80-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/2748-78-0x0000000002890000-0x00000000028CE000-memory.dmp

Filesize
248KB

Download
memory/3028-28-0x000007FEF5BA3000-0x000007FEF5BA4000-memory.dmp

Filesize
4KB

Download
memory/3028-22-0x000007FEF5BA3000-0x000007FEF5BA4000-memory.dmp

Filesize
4KB

Download
memory/3028-23-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download