healer | bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3.exe
Size

522KB
MD5

2b7eebeeb118d69f204e9cb163961de4
SHA1

c05d36f9755576dd47457b921b7b93428315a50b
SHA256

bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3
SHA512

f1c919b1835694eb928981ee98090b89bd0ef2135418f94974806908b0fb43d866f74ce38d47e9dcb4db98c4b823581cab403969425a261a64db4424e9d8c915
SSDEEP

6144:Kly+bnr+Ep0yN90QEbQp1Mt7Ux3o0xFR2vPSmv5wCKYngvikt02tzedvOCdKCRRz:vMrMy901QpM7UlVihfktsC6aro

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c7a-12.dat	healer
behavioral1/memory/1300-15-0x0000000000B70000-0x0000000000B7A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr410302.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr410302.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr410302.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr410302.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr410302.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr410302.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/1604-21-0x00000000025D0000-0x0000000002616000-memory.dmp	family_redline
behavioral1/memory/1604-23-0x0000000005090000-0x00000000050D4000-memory.dmp	family_redline
behavioral1/memory/1604-43-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-63-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-87-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-85-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-83-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-81-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-79-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-77-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-75-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-71-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-69-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-67-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-61-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-57-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-55-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-53-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-49-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-45-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-41-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-37-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-36-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-33-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-31-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-29-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-74-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-65-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-59-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-51-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-47-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-39-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-27-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-25-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline
behavioral1/memory/1604-24-0x0000000005090000-0x00000000050CF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4288	zipE4146.exe
1300	jr410302.exe
1604	ku628948.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr410302.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zipE4146.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zipE4146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku628948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1300	jr410302.exe
1300	jr410302.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	jr410302.exe
Token: SeDebugPrivilege	1604	ku628948.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 4288	3916	bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3.exe	84
PID 3916 wrote to memory of 4288	3916	bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3.exe	84
PID 3916 wrote to memory of 4288	3916	bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3.exe	84
PID 4288 wrote to memory of 1300	4288	zipE4146.exe	85
PID 4288 wrote to memory of 1300	4288	zipE4146.exe	85
PID 4288 wrote to memory of 1604	4288	zipE4146.exe	94
PID 4288 wrote to memory of 1604	4288	zipE4146.exe	94
PID 4288 wrote to memory of 1604	4288	zipE4146.exe	94

C:\Users\Admin\AppData\Local\Temp\bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3.exe
"C:\Users\Admin\AppData\Local\Temp\bd215b4418042b8e0cf0891ffd392a3cf80c77dc81a9a1c4bee9b49f091904f3.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipE4146.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipE4146.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr410302.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr410302.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku628948.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku628948.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipE4146.exe

Filesize
380KB

MD5
0be03a17e75690503ca38faa6516d652

SHA1
50257466bc834674e6bb1164573893fa33e0e0d4

SHA256
543aadd7dc4c13658af7d7ba010251e29130d6ecca109d48fbbbf3f30351daf7

SHA512
5a02a199f749166dfb4d63f329600a53b1bd7a14324e2410d549e98b379a75a206841a9f407242c77ebd05c423e08252ac3febe31085300706cfa8cc29664a80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr410302.exe

Filesize
14KB

MD5
ff31d605d396fb693100fd22adfcab91

SHA1
5cef83430fc118302e98b3b3e15625cb66077463

SHA256
8c9621e3e2f53c931b930094c944b5b687ccfd8efdfd2e3173473d7b26bd7daa

SHA512
fffc4d742debddad9d303a203c10b52f3312c562a85d93440327f5457c70acaa9b8ef74357d524e64a72db7666c47b3e9a24abf46949fd5d1032376d2346d696

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku628948.exe

Filesize
295KB

MD5
1fd0981aeb708b7edd409b0ab79cecff

SHA1
31bb7c54c187958e99a7448e669e60cd9593a098

SHA256
84949cfa9f4d2de487dcc72b7eaa4f4444fd7e7fdf720193a2d6b44eecb6c624

SHA512
1ac64d377b2ee6838858879486decd02f2f7641f3520f923503b3e237a8d64bbc928b5f05af3913b13296bcb40d9dd2b49cae637eb37fc638e0cfe3f5adabe2d

Download Submit
memory/1300-14-0x00007FFB072B3000-0x00007FFB072B5000-memory.dmp

Filesize
8KB

Download
memory/1300-15-0x0000000000B70000-0x0000000000B7A000-memory.dmp

Filesize
40KB

Download
memory/1604-55-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-41-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-23-0x0000000005090000-0x00000000050D4000-memory.dmp

Filesize
272KB

Download
memory/1604-43-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-63-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-87-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-85-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-83-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-81-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-79-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-77-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-75-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-71-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-69-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-67-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-61-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-57-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-21-0x00000000025D0000-0x0000000002616000-memory.dmp

Filesize
280KB

Download
memory/1604-53-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-49-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-45-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-22-0x0000000004AE0000-0x0000000005084000-memory.dmp

Filesize
5.6MB

Download
memory/1604-37-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-36-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-33-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-31-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-29-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-74-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-65-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-59-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-51-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-47-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-39-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-27-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-25-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-24-0x0000000005090000-0x00000000050CF000-memory.dmp

Filesize
252KB

Download
memory/1604-930-0x00000000050F0000-0x0000000005708000-memory.dmp

Filesize
6.1MB

Download
memory/1604-931-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/1604-932-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/1604-933-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/1604-934-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download