healer | 66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe
Size

684KB
MD5

0d30c3898ae05e2498839842af37c332
SHA1

e52eaf4f76a2150f8ae07d189943b10c8e9c019f
SHA256

66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302
SHA512

26511ea6861a15e1d9078342a6d599b33a26562884e78547831c1d5590b5adcf216b869090a7e3a2425b23cd8342fa2962db65e824f8cfec974d83fb47187804
SSDEEP

12288:mMrCy90lg+aMXs5iTyZOPq3kR9E10bhTNk24YSSGF1yrS3qsOR2Vvc2:YyAzhcgWlc9E10bU2cpm5cvR

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c75-12.dat	healer
behavioral1/memory/4560-15-0x0000000000C00000-0x0000000000C0A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr994321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr994321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr994321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr994321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr994321.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr994321.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/3232-2105-0x0000000005750000-0x0000000005782000-memory.dmp	family_redline
behavioral1/files/0x000c000000023c66-2110.dat	family_redline
behavioral1/memory/5892-2118-0x0000000000F40000-0x0000000000F70000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c73-2127.dat	family_redline
behavioral1/memory/756-2129-0x00000000008C0000-0x00000000008EE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	ku399871.exe

Executes dropped EXE 5 IoCs

pid	Process
4628	zipB7603.exe
4560	jr994321.exe
3232	ku399871.exe
5892	1.exe
756	lr452254.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr994321.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zipB7603.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4340	3232	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zipB7603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku399871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr452254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	jr994321.exe
4560	jr994321.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	jr994321.exe
Token: SeDebugPrivilege	3232	ku399871.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4628	1416	66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe	86
PID 1416 wrote to memory of 4628	1416	66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe	86
PID 1416 wrote to memory of 4628	1416	66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe	86
PID 4628 wrote to memory of 4560	4628	zipB7603.exe	87
PID 4628 wrote to memory of 4560	4628	zipB7603.exe	87
PID 4628 wrote to memory of 3232	4628	zipB7603.exe	94
PID 4628 wrote to memory of 3232	4628	zipB7603.exe	94
PID 4628 wrote to memory of 3232	4628	zipB7603.exe	94
PID 3232 wrote to memory of 5892	3232	ku399871.exe	95
PID 3232 wrote to memory of 5892	3232	ku399871.exe	95
PID 3232 wrote to memory of 5892	3232	ku399871.exe	95
PID 1416 wrote to memory of 756	1416	66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe	99
PID 1416 wrote to memory of 756	1416	66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe	99
PID 1416 wrote to memory of 756	1416	66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe	99

C:\Users\Admin\AppData\Local\Temp\66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe
"C:\Users\Admin\AppData\Local\Temp\66abfdc9257e29b60032ccf0cf0e7d937e6fd3ccdf3afba9da41811bb391c302.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipB7603.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipB7603.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994321.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994321.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku399871.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku399871.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 1376
      4⤵
      Program crash
      PID:4340
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr452254.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr452254.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3232 -ip 3232
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr452254.exe

Filesize
169KB

MD5
a4ccaf39d526156b23920bc46a8606aa

SHA1
4a79ba7907aa738242f27ee713ca62edb1d9db4b

SHA256
6e5981125320ba8018c1cfcba3d788e440cabd5360c91bc2325616a340f80b5e

SHA512
5c545eeefbba0b7470d11b0b34312a7c7a30879471a8750a7f553ffcbd56cf7ea496de132f4a819145cd6d90eb5002b47b25280740beab1ca6de351be43db582

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipB7603.exe

Filesize
530KB

MD5
964f348d0750ab8ef4d5f2cf2032f73c

SHA1
023ec2a8a56684e2dc32924df182666d206984dc

SHA256
cdba148ec4d68ee6c43e90c82ffe917237fe2b9517c75c5091739feba204cc1d

SHA512
27c272c3361a578b682ab8192bd84725ea6cd6dd6833287c0d8a464327d65e6a89645af3f63b2427a33e26a53610494325b1dc184d6778b6e7531da82631c920

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr994321.exe

Filesize
12KB

MD5
552407b6e5adc7a0cf4cd5b88ee728b2

SHA1
1a0db32d5e82aa39b6b1cda50f96fd50bff8af94

SHA256
691703006237a133d03fabc21da3f724733fe86502dbf5ad606538fb4b387909

SHA512
c1fdbdae03d96ac0b4c4a73f59cdbad2b7eef2535b2d2abe7268eb6dc66cd60b3f4dceddd57a416194db50d119a382be40856a88f73a52295b444aed6505d623

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku399871.exe

Filesize
495KB

MD5
7087820c98a7e20ced2d4b401d153f5a

SHA1
6aa56345cf3462fe64f3c86ed79cfbb173b560dc

SHA256
8972c2db842ad7191a092110b332b9d4a8a5f801acee2830e370b87e771b743a

SHA512
b6cb05a146d61b2524524a70c02c5a065663fd295b0dd7ba611a777769bb2767318bfe002ee2f795034f25d8debafc62c6d541e087f3dd38df81bb662ae06e1c

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/756-2130-0x0000000001140000-0x0000000001146000-memory.dmp

Filesize
24KB

Download
memory/756-2129-0x00000000008C0000-0x00000000008EE000-memory.dmp

Filesize
184KB

Download
memory/3232-52-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-40-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-45-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-88-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-86-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-84-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-82-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-80-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-76-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-74-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-72-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-70-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-68-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-64-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-62-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-60-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-58-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-56-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-54-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-24-0x0000000005580000-0x00000000055E6000-memory.dmp

Filesize
408KB

Download
memory/3232-48-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-46-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-42-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-28-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-39-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-36-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-34-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-32-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-30-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-78-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-66-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-50-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-26-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-25-0x0000000005580000-0x00000000055DF000-memory.dmp

Filesize
380KB

Download
memory/3232-2105-0x0000000005750000-0x0000000005782000-memory.dmp

Filesize
200KB

Download
memory/3232-22-0x0000000004EE0000-0x0000000004F46000-memory.dmp

Filesize
408KB

Download
memory/3232-23-0x0000000004F90000-0x0000000005534000-memory.dmp

Filesize
5.6MB

Download
memory/4560-16-0x00007FFE0A923000-0x00007FFE0A925000-memory.dmp

Filesize
8KB

Download
memory/4560-15-0x0000000000C00000-0x0000000000C0A000-memory.dmp

Filesize
40KB

Download
memory/4560-14-0x00007FFE0A923000-0x00007FFE0A925000-memory.dmp

Filesize
8KB

Download
memory/5892-2118-0x0000000000F40000-0x0000000000F70000-memory.dmp

Filesize
192KB

Download
memory/5892-2119-0x0000000001680000-0x0000000001686000-memory.dmp

Filesize
24KB

Download
memory/5892-2120-0x0000000005E70000-0x0000000006488000-memory.dmp

Filesize
6.1MB

Download
memory/5892-2121-0x0000000005990000-0x0000000005A9A000-memory.dmp

Filesize
1.0MB

Download
memory/5892-2122-0x00000000058C0000-0x00000000058D2000-memory.dmp

Filesize
72KB

Download
memory/5892-2123-0x0000000005920000-0x000000000595C000-memory.dmp

Filesize
240KB

Download
memory/5892-2124-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

Filesize
304KB

Download