healer | 24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554.exe
Size

536KB
MD5

e72ef88739c07b6003ced2767f9a39e2
SHA1

373405a16cff6496afa21dbe5ea4b283f3948866
SHA256

24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554
SHA512

077bd2fe71358380f7e6717998d0a285362af4a9aa06f2df37c359d405f24cc1832931323deb4ca9576d8674d86cea7dab6627087aaac351960e9622c1af648b
SSDEEP

12288:cMrQy90+k/CWCUO12y87NZztYfmLUO5TNvDX+:My3dJpINZymgOZN6

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b80-12.dat	healer
behavioral1/memory/4140-15-0x0000000000D70000-0x0000000000D7A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr124462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr124462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr124462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr124462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr124462.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr124462.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/3212-22-0x0000000004D20000-0x0000000004D66000-memory.dmp	family_redline
behavioral1/memory/3212-24-0x0000000004DE0000-0x0000000004E24000-memory.dmp	family_redline
behavioral1/memory/3212-30-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-34-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-32-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-28-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-26-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-25-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-88-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-86-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-85-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-82-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-81-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-78-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-76-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-74-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-72-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-70-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-68-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-66-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-64-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-62-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-61-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-58-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-56-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-54-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-52-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-50-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-48-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-46-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-44-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-42-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-40-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-38-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline
behavioral1/memory/3212-36-0x0000000004DE0000-0x0000000004E1F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3404	zimj4104.exe
4140	jr124462.exe
3212	ku496238.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr124462.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zimj4104.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zimj4104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku496238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4140	jr124462.exe
4140	jr124462.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	jr124462.exe
Token: SeDebugPrivilege	3212	ku496238.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 3404	2628	24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554.exe	84
PID 2628 wrote to memory of 3404	2628	24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554.exe	84
PID 2628 wrote to memory of 3404	2628	24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554.exe	84
PID 3404 wrote to memory of 4140	3404	zimj4104.exe	85
PID 3404 wrote to memory of 4140	3404	zimj4104.exe	85
PID 3404 wrote to memory of 3212	3404	zimj4104.exe	96
PID 3404 wrote to memory of 3212	3404	zimj4104.exe	96
PID 3404 wrote to memory of 3212	3404	zimj4104.exe	96

C:\Users\Admin\AppData\Local\Temp\24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554.exe
"C:\Users\Admin\AppData\Local\Temp\24ea9258ea7b2674c55171ecf51a355d1f68122ab8fc74c4113d466632f0f554.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimj4104.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimj4104.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr124462.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr124462.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku496238.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku496238.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimj4104.exe

Filesize
394KB

MD5
9acd2f820d2388b7b7724658d2094e6c

SHA1
b92189fdd576b59ba9e818a701bb8146e5e71c38

SHA256
4159f4d12e678b96edaf43a29139b2c923439992045cbd0603c4f3ee3e36f361

SHA512
403d596aad555679a17c404b76b83c916a5f77d3a1ec04431002240bfb0da554b1bdcb923c33a9eb0920b9a384b19eaa70216def052444fead18b6dc97fc8534

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr124462.exe

Filesize
13KB

MD5
cf9e4c2d88df001afebc8f1fc11e4771

SHA1
787bd87eab03420ecf75a3412d50b0445c76e9fd

SHA256
e3f3c6a4a5ae8973be8f843b3314d3d568c214e455f8b6f5363333697a9ae987

SHA512
37515810818a227dd578a29fd0f871883a8df1bfbc4d265ec7ca932052aa0a4dbbf3864942b93184242025047b6bcba98d8c49b74495086c737f0ec54abe8f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku496238.exe

Filesize
353KB

MD5
2aa21aa03edcb1afb1c577b289e7e21a

SHA1
8aa7b3b21a31e05a849f54e6f2588b0b0346a7f4

SHA256
c6583b3369d074b75bbd9c6686051a74d9847c73aaf7cd84f20372e6e049be44

SHA512
dbadf36e4b9a0d29b5a334622c3de9a683df60153ec04fca37d2508e464ffe034f72435770e8623115f48c18a559b1f2d9d3c3aacee372e1068b2cf9b3498e12

Download Submit
memory/3212-74-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-22-0x0000000004D20000-0x0000000004D66000-memory.dmp

Filesize
280KB

Download
memory/3212-935-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/3212-70-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-23-0x0000000004EC0000-0x0000000005464000-memory.dmp

Filesize
5.6MB

Download
memory/3212-24-0x0000000004DE0000-0x0000000004E24000-memory.dmp

Filesize
272KB

Download
memory/3212-30-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-34-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-32-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-28-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-72-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-25-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-68-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-86-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-85-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-82-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-81-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-78-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-76-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-934-0x0000000005D40000-0x0000000005D7C000-memory.dmp

Filesize
240KB

Download
memory/3212-26-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-933-0x0000000005C20000-0x0000000005C32000-memory.dmp

Filesize
72KB

Download
memory/3212-88-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-66-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-64-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-62-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-61-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-58-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-56-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-54-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-52-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-50-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-48-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-46-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-44-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-42-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-40-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-38-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-36-0x0000000004DE0000-0x0000000004E1F000-memory.dmp

Filesize
252KB

Download
memory/3212-931-0x0000000005470000-0x0000000005A88000-memory.dmp

Filesize
6.1MB

Download
memory/3212-932-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

Filesize
1.0MB

Download
memory/4140-16-0x00007FFCBCD33000-0x00007FFCBCD35000-memory.dmp

Filesize
8KB

Download
memory/4140-14-0x00007FFCBCD33000-0x00007FFCBCD35000-memory.dmp

Filesize
8KB

Download
memory/4140-15-0x0000000000D70000-0x0000000000D7A000-memory.dmp

Filesize
40KB

Download