healer | dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee.exe
Size

530KB
MD5

ab3105555add0a4c64021d32ffe026da
SHA1

4a6e9f842520c2a1e040068e1c8daa5540c66f05
SHA256

dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee
SHA512

4888461ae956792939334c4f7da50e332c5d415c756bd32a29ad27c8de47e5f60cbb28dfb000f9f0c36b608f48dd3377f8d94b31e1061497e2476b9509598ba1
SSDEEP

12288:RMr8y90ncwjGTveh++4oYbJrBT2E87xIMg593Vyk9kgIZ:RyEj4S++kbT2E81vIFyMkPZ

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023ca9-12.dat	healer
behavioral1/memory/3672-15-0x0000000000680000-0x000000000068A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr482893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr482893.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr482893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr482893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr482893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr482893.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/2300-22-0x0000000004C50000-0x0000000004C96000-memory.dmp	family_redline
behavioral1/memory/2300-24-0x0000000007180000-0x00000000071C4000-memory.dmp	family_redline
behavioral1/memory/2300-26-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-38-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-89-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-86-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-84-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-82-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-80-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-78-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-76-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-74-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-72-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-70-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-68-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-66-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-64-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-62-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-58-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-56-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-54-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-52-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-50-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-48-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-46-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-44-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-42-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-36-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-34-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-32-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-30-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-28-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-60-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-40-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2300-25-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2912	zijL7617.exe
3672	jr482893.exe
2300	ku179814.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr482893.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zijL7617.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku179814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zijL7617.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3672	jr482893.exe
3672	jr482893.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3672	jr482893.exe
Token: SeDebugPrivilege	2300	ku179814.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2912	5116	dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee.exe	86
PID 5116 wrote to memory of 2912	5116	dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee.exe	86
PID 5116 wrote to memory of 2912	5116	dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee.exe	86
PID 2912 wrote to memory of 3672	2912	zijL7617.exe	87
PID 2912 wrote to memory of 3672	2912	zijL7617.exe	87
PID 2912 wrote to memory of 2300	2912	zijL7617.exe	96
PID 2912 wrote to memory of 2300	2912	zijL7617.exe	96
PID 2912 wrote to memory of 2300	2912	zijL7617.exe	96

C:\Users\Admin\AppData\Local\Temp\dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee.exe
"C:\Users\Admin\AppData\Local\Temp\dc8c1400157963ca589b84b40c04a0a6486453e7d61bba3e951fce65c979d6ee.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijL7617.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijL7617.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr482893.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr482893.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku179814.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku179814.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijL7617.exe

Filesize
387KB

MD5
d1121f27eb76d683c0fc4155d690c4a2

SHA1
9f4fe1e1455ea87807aec9a93d85c60d80b6046b

SHA256
0519040db191ae3c7e19c7cfddaa6f7d55f9c33b94ffc8fd78655efc6ef18531

SHA512
967bd8afc56433ae8064584f5e4efd2618db3297c596170dea9c2b14facbacca88d12e335e392f17b07e394cee2f5c984eea58da6571cf58c961a3b2a43da58a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr482893.exe

Filesize
11KB

MD5
99e18487964f268048fce7aa653a4709

SHA1
2a337ac27e818346b0d122027126ef8c535a1c03

SHA256
34e1e749928c5eee47ee640a254ae8127c858ec3995c08366426eda82f6ad6c5

SHA512
d0f135096ac84d2cc695afda2ecfb5e6f8e8e3da422153a52c5c5b61169269cfc18cdb7f57277e591d2c96057d37c426a78b2ebd512b157eeca93ae1f43f159f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku179814.exe

Filesize
354KB

MD5
632834b831664085d4da10629b6d8766

SHA1
fc7f53b0823ec92d68396c92e938780c0b2a4c05

SHA256
774312dc7a9940a6a433d358a3789862ba6e165921a7be3e58fe2634c85c9cec

SHA512
f300508318f5685fdfe1e38eb19cdfd57983773a21bc818f1fa894a92f7e35271dc941d6635689faf05d2cf1fdb44c3ab3a058772086c9333265a5fafde99d35

Download Submit
memory/2300-66-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-22-0x0000000004C50000-0x0000000004C96000-memory.dmp

Filesize
280KB

Download
memory/2300-935-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download
memory/2300-62-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-23-0x00000000072F0000-0x0000000007894000-memory.dmp

Filesize
5.6MB

Download
memory/2300-24-0x0000000007180000-0x00000000071C4000-memory.dmp

Filesize
272KB

Download
memory/2300-26-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-38-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-89-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-86-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-64-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-82-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-58-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-78-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-76-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-74-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-72-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-70-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-68-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-934-0x0000000007FD0000-0x000000000800C000-memory.dmp

Filesize
240KB

Download
memory/2300-84-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-933-0x00000000072B0000-0x00000000072C2000-memory.dmp

Filesize
72KB

Download
memory/2300-80-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-56-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-54-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-52-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-50-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-48-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-46-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-44-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-42-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-36-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-34-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-32-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-30-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-28-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-60-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-40-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-25-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2300-931-0x00000000078A0000-0x0000000007EB8000-memory.dmp

Filesize
6.1MB

Download
memory/2300-932-0x0000000007EC0000-0x0000000007FCA000-memory.dmp

Filesize
1.0MB

Download
memory/3672-16-0x00007FFC0CDF3000-0x00007FFC0CDF5000-memory.dmp

Filesize
8KB

Download
memory/3672-14-0x00007FFC0CDF3000-0x00007FFC0CDF5000-memory.dmp

Filesize
8KB

Download
memory/3672-15-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download