healer | 799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe
Size

652KB
MD5

055495c04d477ce63ed5931ee1e023cf
SHA1

d38d5a8cdd9614bf46c420b7127a053b81887842
SHA256

799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2
SHA512

06abcaad1941ceaa8f3f7b835ae5be9e92ce8b385dc62612e9a35f74c7f6ce3af3bfc80b614d3043b6c8f71bbeaab2829e3c87637461e016d5fc4eba2ba234bd
SSDEEP

12288:fMrny90NGFPxUdMOPeu/TKyh6iIrXIPnd5Vokut6Eolc+:MyHtLpmRPd9utIlP

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr452295.exe	healer
behavioral1/memory/5084-15-0x0000000000540000-0x000000000054A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr452295.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr452295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr452295.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr452295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr452295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr452295.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr452295.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4236-2105-0x0000000004B70000-0x0000000004BA2000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/4024-2118-0x0000000000900000-0x0000000000930000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr700791.exe	family_redline
behavioral1/memory/5880-2129-0x0000000000A60000-0x0000000000A8E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku483180.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	ku483180.exe

Executes dropped EXE 5 IoCs

Processes:

ziWD7285.exejr452295.exeku483180.exe1.exelr700791.exe

pid process

4612 ziWD7285.exe
5084 jr452295.exe
4236 ku483180.exe
4024 1.exe
5880 lr700791.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr452295.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr452295.exe

pid	process
4612	ziWD7285.exe
5084	jr452295.exe
4236	ku483180.exe
4024	1.exe
5880	lr700791.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr452295.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exeziWD7285.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziWD7285.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

6224 4236 WerFault.exe ku483180.exe

pid	pid_target	process	target process
6224	4236	WerFault.exe	ku483180.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1.exelr700791.exe799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exeziWD7285.exeku483180.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr700791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziWD7285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku483180.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr452295.exe

pid process

5084 jr452295.exe
5084 jr452295.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr452295.exeku483180.exe

description pid process

Token: SeDebugPrivilege 5084 jr452295.exe
Token: SeDebugPrivilege 4236 ku483180.exe

pid	process
5084	jr452295.exe
5084	jr452295.exe

description	pid	process
Token: SeDebugPrivilege	5084	jr452295.exe
Token: SeDebugPrivilege	4236	ku483180.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exeziWD7285.exeku483180.exe

description	pid	process	target process
PID 3356 wrote to memory of 4612	3356	799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe	ziWD7285.exe
PID 3356 wrote to memory of 4612	3356	799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe	ziWD7285.exe
PID 3356 wrote to memory of 4612	3356	799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe	ziWD7285.exe
PID 4612 wrote to memory of 5084	4612	ziWD7285.exe	jr452295.exe
PID 4612 wrote to memory of 5084	4612	ziWD7285.exe	jr452295.exe
PID 4612 wrote to memory of 4236	4612	ziWD7285.exe	ku483180.exe
PID 4612 wrote to memory of 4236	4612	ziWD7285.exe	ku483180.exe
PID 4612 wrote to memory of 4236	4612	ziWD7285.exe	ku483180.exe
PID 4236 wrote to memory of 4024	4236	ku483180.exe	1.exe
PID 4236 wrote to memory of 4024	4236	ku483180.exe	1.exe
PID 4236 wrote to memory of 4024	4236	ku483180.exe	1.exe
PID 3356 wrote to memory of 5880	3356	799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe	lr700791.exe
PID 3356 wrote to memory of 5880	3356	799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe	lr700791.exe
PID 3356 wrote to memory of 5880	3356	799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe	lr700791.exe

C:\Users\Admin\AppData\Local\Temp\799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe
"C:\Users\Admin\AppData\Local\Temp\799fdda9fa4eed477a99bcdc713e10470c0470b5c0e8c99a28f16c5d89eb34a2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWD7285.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWD7285.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr452295.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr452295.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku483180.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku483180.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 1384
4⤵
- Program crash
PID:6224

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr700791.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr700791.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4236 -ip 4236
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr700791.exe

Filesize
169KB

MD5
6a4d9966335532757e3d9efb4327ae39

SHA1
1165d664e6c194f61d9c09cfed3f5c96472b6c3b

SHA256
4b632508664ff8953766aba38ae7709f3e78577872aadf32cc0c72ba95659a58

SHA512
b1cd52c6118782f3f28ddf36bab20eef9de1529446048273daa7127e4900e4ae3d97b87887568fb5f5e0b4da0c111daaca0d558a9a67cabd0983d1289f356a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWD7285.exe

Filesize
498KB

MD5
43f5ab22f3e6396c1907e43a845877de

SHA1
c5bbf76dcf1b541920c4f77b73cc51ff2d20d9e4

SHA256
cb6ba9fe28c361d369f7882ca854840823e252716bbdd0ba38869d83afcae036

SHA512
5f7c66b5b6871fe90d9b215856a0b815cd49b6dea63266dab25975c1a531634b6a4fe265c32da3c1bae248ccc4f2e1aab68cc03a0b916a779fff942aabe58754

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr452295.exe

Filesize
12KB

MD5
79ef16898eeb292ebef34611504bf248

SHA1
50c67e8cb8c970b72d4289fb0b65915e3e2739be

SHA256
4920f82b3a9751bcf49ed2e5ea826772ab411c8c8fdfe937bfc809a7dcfb2ab8

SHA512
09d5063e2bd41d0d3fe482d1def36032580c8e869de8d2fb25c05b92995c36002e768a1f2f8037a5babae33eb0b7c043ba13f56b6991024a550f07b93521dbc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku483180.exe

Filesize
417KB

MD5
d3bd24919edbd89ebefda18d6e97c630

SHA1
6782d862de993671bb67bee5fbf76008bda6fe41

SHA256
8bdcfa83522b99b434fc1baf9e5115c03c5675bcc0ddd97ceec1135b315f046f

SHA512
d99f15091a1e9ec2bc3e3788cc934b6daab1cb6b0aa74400cf754d2a227a1c3ce0f7d99ec10e7e7eb655c9709186f01ad1a62e3d578da2e259affb889d546b97

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/4024-2118-0x0000000000900000-0x0000000000930000-memory.dmp

Filesize
192KB

Download
memory/4024-2124-0x0000000005340000-0x000000000538C000-memory.dmp

Filesize
304KB

Download
memory/4024-2123-0x0000000005300000-0x000000000533C000-memory.dmp

Filesize
240KB

Download
memory/4024-2122-0x0000000005170000-0x0000000005182000-memory.dmp

Filesize
72KB

Download
memory/4024-2121-0x00000000053D0000-0x00000000054DA000-memory.dmp

Filesize
1.0MB

Download
memory/4024-2120-0x00000000058E0000-0x0000000005EF8000-memory.dmp

Filesize
6.1MB

Download
memory/4024-2119-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Filesize
24KB

Download
memory/4236-54-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-36-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-80-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-78-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-76-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-73-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-70-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-68-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-66-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-64-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-62-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-60-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-58-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-56-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-84-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-52-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-50-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-46-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-44-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-42-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-38-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-82-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-34-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-32-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-30-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-28-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-74-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-48-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-86-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-88-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-40-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-26-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-24-0x0000000005260000-0x00000000052C6000-memory.dmp

Filesize
408KB

Download
memory/4236-23-0x0000000004CB0000-0x0000000005254000-memory.dmp

Filesize
5.6MB

Download
memory/4236-22-0x0000000004B00000-0x0000000004B66000-memory.dmp

Filesize
408KB

Download
memory/4236-25-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/4236-2105-0x0000000004B70000-0x0000000004BA2000-memory.dmp

Filesize
200KB

Download
memory/5084-14-0x00007FFBBD1E3000-0x00007FFBBD1E5000-memory.dmp

Filesize
8KB

Download
memory/5084-15-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download
memory/5084-16-0x00007FFBBD1E3000-0x00007FFBBD1E5000-memory.dmp

Filesize
8KB

Download
memory/5880-2129-0x0000000000A60000-0x0000000000A8E000-memory.dmp

Filesize
184KB

Download
memory/5880-2130-0x0000000001440000-0x0000000001446000-memory.dmp

Filesize
24KB

Download