healer | 979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a.exe
Size

537KB
MD5

b72bc113c4aedb6ae171765fb8d3e233
SHA1

d6937b67fcecdc6539fd7b7fc74a6a8cd4246e51
SHA256

979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a
SHA512

4dabc69462a8a72831ba2a7a460e3668faeb054e5467553c4babc5ff365e1206c73c6fb4bdb46ee57f81b139ba4ffe06b6edcdb4ef3c345ca6b73625b9b16b12
SSDEEP

12288:9MrQy90jmutxEZw2LlTIEJ6CFxIMrPUE7:Vy2DYlTTJFiMrPf7

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023c9f-12.dat	healer
behavioral1/memory/464-15-0x0000000000A70000-0x0000000000A7A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr082277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr082277.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr082277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr082277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr082277.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr082277.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/3144-22-0x0000000002350000-0x0000000002396000-memory.dmp	family_redline
behavioral1/memory/3144-24-0x0000000004B20000-0x0000000004B64000-memory.dmp	family_redline
behavioral1/memory/3144-25-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-84-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-82-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-50-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-36-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-26-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-88-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-87-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-80-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-78-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-76-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-74-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-72-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-70-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-68-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-66-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-65-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-62-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-60-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-58-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-56-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-54-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-53-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-48-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-46-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-44-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-42-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-40-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-38-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-34-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-32-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-30-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline
behavioral1/memory/3144-28-0x0000000004B20000-0x0000000004B5F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2956	ziKW8268.exe
464	jr082277.exe
3144	ku802773.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr082277.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziKW8268.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziKW8268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku802773.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
464	jr082277.exe
464	jr082277.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	jr082277.exe
Token: SeDebugPrivilege	3144	ku802773.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2956	1556	979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a.exe	84
PID 1556 wrote to memory of 2956	1556	979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a.exe	84
PID 1556 wrote to memory of 2956	1556	979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a.exe	84
PID 2956 wrote to memory of 464	2956	ziKW8268.exe	85
PID 2956 wrote to memory of 464	2956	ziKW8268.exe	85
PID 2956 wrote to memory of 3144	2956	ziKW8268.exe	95
PID 2956 wrote to memory of 3144	2956	ziKW8268.exe	95
PID 2956 wrote to memory of 3144	2956	ziKW8268.exe	95

C:\Users\Admin\AppData\Local\Temp\979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a.exe
"C:\Users\Admin\AppData\Local\Temp\979ce4c83c3f8460d3ff13a7e37d102d635dab048f4795feb5a9e3c19f40851a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKW8268.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKW8268.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr082277.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr082277.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:464
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku802773.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku802773.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKW8268.exe

Filesize
383KB

MD5
e725c93a4dfa82de10ab381f25421521

SHA1
4bf1dd0315f142f5c643ab65c7c4bdb741b51509

SHA256
b37085166f2f96028c5ff8859c0c89f0df07ac6e54102c16412fc740bd8792bb

SHA512
2e82a71a4dcfb28fcba129182872f82e6ba5e50af007af6e27419902ed85e9668e04575479f5a8dade5c66d640a74a200de72ff382a3f5a5401544759cea2820

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr082277.exe

Filesize
13KB

MD5
18e4e8a529a08a0d453d509cc4a44665

SHA1
0dfc8ce833e94545ba31a5b41c722664021aac44

SHA256
349ca83cbed28a8a42764969725bb9b049565b613842a3954a041d474fb0e62d

SHA512
8b81a06ff7c021fd3299b2140641e2f18a6ccabde04c79c962bfbca410addf5938795cc2de84e0778a15f5ada6b394ee6e56d2787430be801d6fc572c0accd19

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku802773.exe

Filesize
311KB

MD5
f08288e82dbcd0baf6946d22e258a571

SHA1
b0a27cf2946f4b5b2bf63e25f5741a08edecb90e

SHA256
259c815cd250775a3dd0048f14a6b873ec90b791a2aa137c550160eab3e1b224

SHA512
df194e0e721819518a07a0223127b7bcef92bc1f6c7737ec38c32a2789d861a50d5ab728b028437ec1dd802fe0398eba5c62f32238efdecda67aa2a44bbdcc5b

Download Submit
memory/464-14-0x00007FFCD3CA3000-0x00007FFCD3CA5000-memory.dmp

Filesize
8KB

Download
memory/464-15-0x0000000000A70000-0x0000000000A7A000-memory.dmp

Filesize
40KB

Download
memory/464-16-0x00007FFCD3CA3000-0x00007FFCD3CA5000-memory.dmp

Filesize
8KB

Download
memory/3144-70-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-60-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-24-0x0000000004B20000-0x0000000004B64000-memory.dmp

Filesize
272KB

Download
memory/3144-25-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-84-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-82-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-50-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-36-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-26-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-88-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-87-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-80-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-78-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-76-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-74-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-72-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-22-0x0000000002350000-0x0000000002396000-memory.dmp

Filesize
280KB

Download
memory/3144-68-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-66-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-65-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-62-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-23-0x0000000004CD0000-0x0000000005274000-memory.dmp

Filesize
5.6MB

Download
memory/3144-58-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-56-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-54-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-53-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-48-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-46-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-44-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-42-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-40-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-38-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-34-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-32-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-30-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-28-0x0000000004B20000-0x0000000004B5F000-memory.dmp

Filesize
252KB

Download
memory/3144-931-0x0000000005280000-0x0000000005898000-memory.dmp

Filesize
6.1MB

Download
memory/3144-932-0x0000000004BB0000-0x0000000004CBA000-memory.dmp

Filesize
1.0MB

Download
memory/3144-933-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/3144-934-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/3144-935-0x0000000005A80000-0x0000000005ACC000-memory.dmp

Filesize
304KB

Download