healer | 03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe
Size

560KB
MD5

0ad2acd136a20f6f3a7774413e1768b4
SHA1

9baec6382df63379d888c9536ec861ad30cffa77
SHA256

03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0
SHA512

4a592df8437730a857bab8611be7ab24b05fe3d2e6ce1bbcf4eb075df9e520f02f4083cf9f1ea820beadc743922b0fb50ee90c9fa38ab4199d65fca9c7ac733f
SSDEEP

12288:HMriy90LLodW+bjXwj7696k7p4YWiQxKZm0OUINS+:NyiLWbjYy60p4YW5kZm0OUx+

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr671702.exe	healer
behavioral1/memory/1632-15-0x0000000000D90000-0x0000000000D9A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr671702.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr671702.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr671702.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr671702.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr671702.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr671702.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr671702.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2012-22-0x0000000002810000-0x0000000002856000-memory.dmp	family_redline
behavioral1/memory/2012-24-0x0000000004DF0000-0x0000000004E34000-memory.dmp	family_redline
behavioral1/memory/2012-38-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-36-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-34-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-32-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-86-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-76-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-64-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-30-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-28-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-26-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-25-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-88-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-84-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-82-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-80-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-78-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-74-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-72-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-70-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-68-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-66-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-62-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-60-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-58-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-57-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-54-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-52-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-50-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-48-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-46-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-44-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-42-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline
behavioral1/memory/2012-40-0x0000000004DF0000-0x0000000004E2F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziwN7954.exejr671702.exeku791590.exe

pid process

1216 ziwN7954.exe
1632 jr671702.exe
2012 ku791590.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr671702.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr671702.exe

pid	process
1216	ziwN7954.exe
1632	jr671702.exe
2012	ku791590.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr671702.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ziwN7954.exe03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziwN7954.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

60 sc.exe

pid	process
60	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exeziwN7954.exeku791590.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziwN7954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku791590.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr671702.exe

pid process

1632 jr671702.exe
1632 jr671702.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr671702.exeku791590.exe

description pid process

Token: SeDebugPrivilege 1632 jr671702.exe
Token: SeDebugPrivilege 2012 ku791590.exe

pid	process
1632	jr671702.exe
1632	jr671702.exe

description	pid	process
Token: SeDebugPrivilege	1632	jr671702.exe
Token: SeDebugPrivilege	2012	ku791590.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exeziwN7954.exe

description	pid	process	target process
PID 1092 wrote to memory of 1216	1092	03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe	ziwN7954.exe
PID 1092 wrote to memory of 1216	1092	03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe	ziwN7954.exe
PID 1092 wrote to memory of 1216	1092	03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe	ziwN7954.exe
PID 1216 wrote to memory of 1632	1216	ziwN7954.exe	jr671702.exe
PID 1216 wrote to memory of 1632	1216	ziwN7954.exe	jr671702.exe
PID 1216 wrote to memory of 2012	1216	ziwN7954.exe	ku791590.exe
PID 1216 wrote to memory of 2012	1216	ziwN7954.exe	ku791590.exe
PID 1216 wrote to memory of 2012	1216	ziwN7954.exe	ku791590.exe

C:\Users\Admin\AppData\Local\Temp\03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe
"C:\Users\Admin\AppData\Local\Temp\03bb9d4dcfd449544fcb2fb440e5591c010a6b2ca3294dc3402f5f82d49144a0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwN7954.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwN7954.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr671702.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr671702.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku791590.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku791590.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwN7954.exe

Filesize
407KB

MD5
5125fea7ddad726845caf33979c62ab9

SHA1
9607a0ed0ef5c3af00b9efba4f2b4afbde08f693

SHA256
263c78ebc8f411fee934cbd678f82898b354044151422560f2688713df3148d7

SHA512
3d70ce439d054b8088d0a2d3b09c0af3c9d7d0e9ff0ee3261214428fea229ef55b348e5c37b0f2fa2c9e55f330abe0782d66ffefe5a8b6756d4fe70a68c8fac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr671702.exe

Filesize
13KB

MD5
71e84173b049867be48f959c7e92a72a

SHA1
aa277191f3d699d20ba9e0c530181409c58a2553

SHA256
d884a23f6ca217a44be51f95891eda7e79a3fbcc597b76d642424554132033d5

SHA512
16f3338341fede5b51d70b2db74b7a0cf1bef5f33084cb9f8274920156dc57c4344b0fcd8d09a89f4d000508dd4227cc00c586245483036b62f484d0c4693784

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku791590.exe

Filesize
370KB

MD5
7b87337d27c476a793a57c862d66373a

SHA1
567aae1841814d61ce445458dc81c1284185a80b

SHA256
2da7fb7f7ad0767a251fecb2b9f6de82f04a8ff3ef4e53a423e8368dd7234fe7

SHA512
0e66a8476f6846c722046bea3f89810f327324e3d31986852873db7d6996a38031d7f75d14074a8a1eb513b722555a6822d9aa174e8ee604cb5410feb4451e4f

Download Submit
memory/1632-14-0x00007FF8408F3000-0x00007FF8408F5000-memory.dmp

Filesize
8KB

Download
memory/1632-15-0x0000000000D90000-0x0000000000D9A000-memory.dmp

Filesize
40KB

Download
memory/1632-16-0x00007FF8408F3000-0x00007FF8408F5000-memory.dmp

Filesize
8KB

Download
memory/2012-82-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-70-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-24-0x0000000004DF0000-0x0000000004E34000-memory.dmp

Filesize
272KB

Download
memory/2012-38-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-36-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-34-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-32-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-86-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-76-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-64-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-30-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-28-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-26-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-25-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-88-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-84-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-22-0x0000000002810000-0x0000000002856000-memory.dmp

Filesize
280KB

Download
memory/2012-80-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-78-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-74-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-72-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-23-0x0000000004E90000-0x0000000005434000-memory.dmp

Filesize
5.6MB

Download
memory/2012-68-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-66-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-62-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-60-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-58-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-57-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-54-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-52-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-50-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-48-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-46-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-44-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-42-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-40-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

Filesize
252KB

Download
memory/2012-931-0x0000000005590000-0x0000000005BA8000-memory.dmp

Filesize
6.1MB

Download
memory/2012-932-0x0000000005C30000-0x0000000005D3A000-memory.dmp

Filesize
1.0MB

Download
memory/2012-933-0x0000000005D70000-0x0000000005D82000-memory.dmp

Filesize
72KB

Download
memory/2012-934-0x0000000005D90000-0x0000000005DCC000-memory.dmp

Filesize
240KB

Download
memory/2012-935-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

Filesize
304KB

Download