healer | eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exe
Size

530KB
MD5

8e71855945775e0fe197931d1feddfe3
SHA1

226fa2555ecd82a304bafdf5efa86e91045377e9
SHA256

eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84
SHA512

ff537713d25f2840c00220306290164e8169b75d8bc3bfb36df4746521ad2dda49b146410d12ccb7ed89831d61bb606dab9c0cd421493ba1f07b34faaaac61c3
SSDEEP

12288:jMrIy905OQFRpkNn6DmvprPg1ZFIg0i8+Vx4ieebh:vyWfQF6WlPg1ZGBiBp

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr125765.exe	healer
behavioral1/memory/5056-15-0x00000000003C0000-0x00000000003CA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr125765.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr125765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr125765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr125765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr125765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr125765.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr125765.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3448-22-0x0000000002830000-0x0000000002876000-memory.dmp	family_redline
behavioral1/memory/3448-24-0x0000000004E00000-0x0000000004E44000-memory.dmp	family_redline
behavioral1/memory/3448-28-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-26-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-25-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-38-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-88-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-84-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-62-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-60-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-58-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-56-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-54-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-50-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-48-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-46-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-44-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-42-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-41-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-36-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-34-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-32-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-30-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/3448-52-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

zidP5497.exejr125765.exeku489609.exe

pid process

5100 zidP5497.exe
5056 jr125765.exe
3448 ku489609.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr125765.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr125765.exe

pid	process
5100	zidP5497.exe
5056	jr125765.exe
3448	ku489609.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr125765.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exezidP5497.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zidP5497.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exezidP5497.exeku489609.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zidP5497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku489609.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr125765.exe

pid process

5056 jr125765.exe
5056 jr125765.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr125765.exeku489609.exe

description pid process

Token: SeDebugPrivilege 5056 jr125765.exe
Token: SeDebugPrivilege 3448 ku489609.exe

pid	process
5056	jr125765.exe
5056	jr125765.exe

description	pid	process
Token: SeDebugPrivilege	5056	jr125765.exe
Token: SeDebugPrivilege	3448	ku489609.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exezidP5497.exe

description	pid	process	target process
PID 2516 wrote to memory of 5100	2516	eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exe	zidP5497.exe
PID 2516 wrote to memory of 5100	2516	eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exe	zidP5497.exe
PID 2516 wrote to memory of 5100	2516	eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exe	zidP5497.exe
PID 5100 wrote to memory of 5056	5100	zidP5497.exe	jr125765.exe
PID 5100 wrote to memory of 5056	5100	zidP5497.exe	jr125765.exe
PID 5100 wrote to memory of 3448	5100	zidP5497.exe	ku489609.exe
PID 5100 wrote to memory of 3448	5100	zidP5497.exe	ku489609.exe
PID 5100 wrote to memory of 3448	5100	zidP5497.exe	ku489609.exe

C:\Users\Admin\AppData\Local\Temp\eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exe
"C:\Users\Admin\AppData\Local\Temp\eee07243c70700b265e4e0c39fc3c1711c6c2cc25c63eb7596a14b2fc65caf84.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidP5497.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidP5497.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr125765.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr125765.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku489609.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku489609.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidP5497.exe

Filesize
388KB

MD5
03c5174e6ce641d1a69d562f123aa90a

SHA1
95ce13c54fd239d1c993edf655cc09abcaaaf06c

SHA256
626a35205878c6c9175fe0021cee163da70c3d25749e050d46ac27baf1b9c561

SHA512
33be63ef517491e7561a62d94e245dd168731d3d02be43cfe3c6c5bed7c553436d07739961cc8a231ada369823380cd4578f743ed27f02818714b508f3731d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr125765.exe

Filesize
12KB

MD5
011bb041a80ffaf78883a0c624bc8b7d

SHA1
221737ea7d7f4de76c0aeee1c05238bf57164d10

SHA256
474ded7ed0709fd7790bf8043f71cfd4e648a1f4bcd363de365816b35ac156f1

SHA512
0544d1e416971f3437312428aec90d8a721de2caa00f2c3318a6e59ac5cc71fa531087f48b416ff2c0b94fac678b1a4b71d1eda590e3d76ca026aa79bf829ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku489609.exe

Filesize
434KB

MD5
6e75dcccc5bc5a245877f02ec41be380

SHA1
60fb53c7fe4de33aa5e6672c36463cf4132e7035

SHA256
cf166b54877a969e3c3f17fa543aaa30ac1173ec11a4ca4e71d73f38878ae6a7

SHA512
e701b0df7e1d17c16c7f4ef1217413b88d69dc29619c7ddab4fffaf515e0f5d0c0d02858a4422e85694d50da2c3c0b97d8ed210d469aa6c2932827a9b6dfa86e

Download Submit
memory/3448-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-22-0x0000000002830000-0x0000000002876000-memory.dmp

Filesize
280KB

Download
memory/3448-935-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download
memory/3448-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-23-0x0000000004EA0000-0x0000000005444000-memory.dmp

Filesize
5.6MB

Download
memory/3448-24-0x0000000004E00000-0x0000000004E44000-memory.dmp

Filesize
272KB

Download
memory/3448-28-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-26-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-25-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-38-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-62-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-934-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/3448-88-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-933-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/3448-84-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-60-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-58-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-56-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-54-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-50-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-48-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-46-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-44-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-42-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-41-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-36-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-34-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-32-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-30-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-52-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/3448-931-0x0000000005460000-0x0000000005A78000-memory.dmp

Filesize
6.1MB

Download
memory/3448-932-0x0000000005B00000-0x0000000005C0A000-memory.dmp

Filesize
1.0MB

Download
memory/5056-16-0x00007FFA0A613000-0x00007FFA0A615000-memory.dmp

Filesize
8KB

Download
memory/5056-14-0x00007FFA0A613000-0x00007FFA0A615000-memory.dmp

Filesize
8KB

Download
memory/5056-15-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download