healer | cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe
Size

522KB
MD5

1f7049fec0de8df73f585d32242e52f6
SHA1

e80ed30d4527c6a790fe0ed2a2eaf3a3ea1d9dc8
SHA256

cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c
SHA512

42a179759fc60a4074a220a460d66ac68e79c8f422f1d8689cb1854e8e9257093816a874eb86f69baa3896ac100cfd5e1ac56381e5f759ac92b8c81fd9de801d
SSDEEP

12288:OMrLy90FjMwNEWYJPv8ze44azWHw5Xv8Je0h2x:9yigmcUzX4jHT5C

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr872358.exe	healer
behavioral1/memory/3284-15-0x0000000000040000-0x000000000004A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr872358.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr872358.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr872358.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr872358.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr872358.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr872358.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr872358.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4448-21-0x00000000024C0000-0x0000000002506000-memory.dmp	family_redline
behavioral1/memory/4448-23-0x0000000002650000-0x0000000002694000-memory.dmp	family_redline
behavioral1/memory/4448-87-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-79-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-85-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-83-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-81-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-77-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-75-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-73-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-71-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-69-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-67-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-65-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-63-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-61-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-59-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-57-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-55-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-53-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-51-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-49-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-47-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-45-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-43-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-41-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-39-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-37-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-35-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-33-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-31-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-29-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-27-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-25-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline
behavioral1/memory/4448-24-0x0000000002650000-0x000000000268F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziQE8142.exejr872358.exeku978624.exe

pid process

3636 ziQE8142.exe
3284 jr872358.exe
4448 ku978624.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr872358.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr872358.exe

pid	process
3636	ziQE8142.exe
3284	jr872358.exe
4448	ku978624.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr872358.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exeziQE8142.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziQE8142.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ziQE8142.exeku978624.execde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziQE8142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku978624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr872358.exe

pid process

3284 jr872358.exe
3284 jr872358.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr872358.exeku978624.exe

description pid process

Token: SeDebugPrivilege 3284 jr872358.exe
Token: SeDebugPrivilege 4448 ku978624.exe

pid	process
3284	jr872358.exe
3284	jr872358.exe

description	pid	process
Token: SeDebugPrivilege	3284	jr872358.exe
Token: SeDebugPrivilege	4448	ku978624.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exeziQE8142.exe

description	pid	process	target process
PID 4564 wrote to memory of 3636	4564	cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe	ziQE8142.exe
PID 4564 wrote to memory of 3636	4564	cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe	ziQE8142.exe
PID 4564 wrote to memory of 3636	4564	cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe	ziQE8142.exe
PID 3636 wrote to memory of 3284	3636	ziQE8142.exe	jr872358.exe
PID 3636 wrote to memory of 3284	3636	ziQE8142.exe	jr872358.exe
PID 3636 wrote to memory of 4448	3636	ziQE8142.exe	ku978624.exe
PID 3636 wrote to memory of 4448	3636	ziQE8142.exe	ku978624.exe
PID 3636 wrote to memory of 4448	3636	ziQE8142.exe	ku978624.exe

C:\Users\Admin\AppData\Local\Temp\cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe
"C:\Users\Admin\AppData\Local\Temp\cde79ccd567208f34feab8c3adb57c490c38d19c08bfd9ee0421c115dda6b83c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQE8142.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQE8142.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr872358.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr872358.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku978624.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku978624.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQE8142.exe

Filesize
380KB

MD5
eb052895afa3c0b912d9afadc6474242

SHA1
f22f5d02784e6b1e50f209058939d2c967dd4af3

SHA256
d87e91b984789f469f44d99f1284f08dc25f82f6f0c3c9d6d2deb5c2e70c0575

SHA512
bec3ef51524bc85ae763bcab2e376196ac352d3f29d90c189bd4f7727a8c4a0e715fc6066505484399fa5489c3411b1d89dc9bb0c6742071ace237111ebd24fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr872358.exe

Filesize
15KB

MD5
c5ed91ebb3114edf229b7fe13883a879

SHA1
2a09d4ca8a409568484c7ac6fbad8d9652b09c86

SHA256
975358f120f748b429c43efcadac0c362842d497c99ec87f0ac9cf5be4043333

SHA512
b0fecaed62f8bf0626d51e088f8a547668d562e8811e31e44934375e1357b0c2e2fdba5b75e8e228969e56d4ee85d6c0ca7e171bc955cb734a059402cca42f05

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku978624.exe

Filesize
294KB

MD5
62d6895ef59703f8a0fe7467706fd03d

SHA1
6ab7c97a46914fb84849ebfdbc252db91fa00f89

SHA256
7f8e25516426b08fb19ebf6b665003d1f53fde93da91be1b77224ac7c8648fd1

SHA512
494b1edadf5094d7a5310ee6bbb106d3ef6d5f269d4d4d4a0b035713f08419af801488cefbf5dd7f9c0d8089ca4f153eb2ffac8385a48ad9ea63c87b8d7cd1c4

Download Submit
memory/3284-15-0x0000000000040000-0x000000000004A000-memory.dmp

Filesize
40KB

Download
memory/3284-14-0x00007FFFE0CD3000-0x00007FFFE0CD5000-memory.dmp

Filesize
8KB

Download
memory/4448-59-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-51-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-23-0x0000000002650000-0x0000000002694000-memory.dmp

Filesize
272KB

Download
memory/4448-87-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-79-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-85-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-83-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-81-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-77-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-75-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-73-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-71-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-69-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-67-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-65-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-63-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-61-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-21-0x00000000024C0000-0x0000000002506000-memory.dmp

Filesize
280KB

Download
memory/4448-57-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-55-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-53-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-22-0x0000000004C80000-0x0000000005224000-memory.dmp

Filesize
5.6MB

Download
memory/4448-49-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-47-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-45-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-43-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-41-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-39-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-37-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-35-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-33-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-31-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-29-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-27-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-25-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-24-0x0000000002650000-0x000000000268F000-memory.dmp

Filesize
252KB

Download
memory/4448-930-0x0000000005230000-0x0000000005848000-memory.dmp

Filesize
6.1MB

Download
memory/4448-931-0x0000000005850000-0x000000000595A000-memory.dmp

Filesize
1.0MB

Download
memory/4448-932-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/4448-933-0x0000000004C00000-0x0000000004C3C000-memory.dmp

Filesize
240KB

Download
memory/4448-934-0x0000000005A60000-0x0000000005AAC000-memory.dmp

Filesize
304KB

Download