healer | 9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe
Size

661KB
MD5

3d2e60698eb7cc50b201c33f71004c8f
SHA1

770b63759ff80bde15ea7edb70e7f64ec0287bf4
SHA256

9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36
SHA512

e04649185eca2f3e8b51f582f8f704e28f9798f999bffa92b5b6d0fac926b7da4734afd795c9f5f2a8a15a8603f1ad8bbda44934fc2c88398b41ff49dc18c219
SSDEEP

12288:QMriy90avfWxXin4gdscsOoEZwjBf77ysKYzc2iqSzc9RXeI7QeB1l:iy7WVi4gyJOFZwjBzJ42iqE6b1l

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr329968.exe	healer
behavioral1/memory/1200-15-0x0000000000580000-0x000000000058A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr329968.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr329968.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr329968.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr329968.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr329968.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr329968.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr329968.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3644-2105-0x0000000005420000-0x0000000005452000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/3660-2118-0x0000000000350000-0x0000000000380000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr322363.exe	family_redline
behavioral1/memory/6048-2129-0x00000000008B0000-0x00000000008DE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku557172.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	ku557172.exe

Executes dropped EXE 5 IoCs

Processes:

ziIu0312.exejr329968.exeku557172.exe1.exelr322363.exe

pid process

2640 ziIu0312.exe
1200 jr329968.exe
3644 ku557172.exe
3660 1.exe
6048 lr322363.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr329968.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr329968.exe

pid	process
2640	ziIu0312.exe
1200	jr329968.exe
3644	ku557172.exe
3660	1.exe
6048	lr322363.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr329968.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exeziIu0312.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziIu0312.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5884 3644 WerFault.exe ku557172.exe

pid	pid_target	process	target process
5884	3644	WerFault.exe	ku557172.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

lr322363.exe9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exeziIu0312.exeku557172.exe1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr322363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziIu0312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku557172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr329968.exe

pid process

1200 jr329968.exe
1200 jr329968.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr329968.exeku557172.exe

description pid process

Token: SeDebugPrivilege 1200 jr329968.exe
Token: SeDebugPrivilege 3644 ku557172.exe

pid	process
1200	jr329968.exe
1200	jr329968.exe

description	pid	process
Token: SeDebugPrivilege	1200	jr329968.exe
Token: SeDebugPrivilege	3644	ku557172.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exeziIu0312.exeku557172.exe

description	pid	process	target process
PID 1112 wrote to memory of 2640	1112	9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe	ziIu0312.exe
PID 1112 wrote to memory of 2640	1112	9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe	ziIu0312.exe
PID 1112 wrote to memory of 2640	1112	9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe	ziIu0312.exe
PID 2640 wrote to memory of 1200	2640	ziIu0312.exe	jr329968.exe
PID 2640 wrote to memory of 1200	2640	ziIu0312.exe	jr329968.exe
PID 2640 wrote to memory of 3644	2640	ziIu0312.exe	ku557172.exe
PID 2640 wrote to memory of 3644	2640	ziIu0312.exe	ku557172.exe
PID 2640 wrote to memory of 3644	2640	ziIu0312.exe	ku557172.exe
PID 3644 wrote to memory of 3660	3644	ku557172.exe	1.exe
PID 3644 wrote to memory of 3660	3644	ku557172.exe	1.exe
PID 3644 wrote to memory of 3660	3644	ku557172.exe	1.exe
PID 1112 wrote to memory of 6048	1112	9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe	lr322363.exe
PID 1112 wrote to memory of 6048	1112	9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe	lr322363.exe
PID 1112 wrote to memory of 6048	1112	9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe	lr322363.exe

C:\Users\Admin\AppData\Local\Temp\9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe
"C:\Users\Admin\AppData\Local\Temp\9ca111c32df27c3721cfc1fb133c7c482b221b7b611589e42f9efb4511c58f36.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIu0312.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIu0312.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr329968.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr329968.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku557172.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku557172.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1376
4⤵
- Program crash
PID:5884

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr322363.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr322363.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3644 -ip 3644
1⤵
PID:5680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr322363.exe

Filesize
168KB

MD5
2cced9ad2aea93c4e6ed77afde4cebb9

SHA1
20aadafb46044f6227e88db8170aa177f3424ea1

SHA256
a6cd5e579a5e23159754c7ec7ae87e7c1a87c068cae50e52e6e96b5b5d1d5150

SHA512
22552f1df1441d01ec52f11805e5cc606dd47485a105bfc87b44e1a0b2e4af057ed26614a4d3f84bb6f3bce3dfb659d4542075e6270aef1f9115181ef5f0dea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziIu0312.exe

Filesize
507KB

MD5
4a7b312a777869728634201884b89115

SHA1
bfc74586003733ec77bbdde62961e4d13a49d571

SHA256
6d8698e458b54830d2a4562407a95f10b64db34b07f0245820c02d866de21929

SHA512
767c036c61510c422d470359a231ef1ced8efdbb6afd618846300f0ed04c3c3ac3e56dec8e8d31cb9b83ee9717c4c3083dffc2b0ca5811a4583075f9413b2393

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr329968.exe

Filesize
11KB

MD5
31946c1df259ded1f9d78f5175ba2908

SHA1
16335b20eba6a3c8ff6ad500344d6d1bcc0e5b06

SHA256
27db2aa1b906d41dadfef28aa13cdd93de2352a623765d2241b45ec9844310d3

SHA512
205ec4058279f5bb59fd7b3b6c52d19145540370b4fff1423daea9931398074f8de423d54259e44a703ece88de8f3b052050bb664b1ad0a270d3bd447de57c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku557172.exe

Filesize
435KB

MD5
95b0a2efe73380432b28da10b1e023da

SHA1
573ef2e37783f15f6a05f6303ccb91e76665b353

SHA256
0a15b9c3a3c8ab1df7b8122d613d22735bc74eee56e6bcbe3354627ca05cdc7d

SHA512
a05fdcd40b206334d92bbbdf120a8a54c33cb33aeb21473ca33163245b8a022fe74c64e07a16738d7a62cb66c5fbcf32ae13b664790287ad5c52a6b9f756aab3

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1200-14-0x00007FFD35723000-0x00007FFD35725000-memory.dmp

Filesize
8KB

Download
memory/1200-15-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/1200-16-0x00007FFD35723000-0x00007FFD35725000-memory.dmp

Filesize
8KB

Download
memory/3644-22-0x00000000026C0000-0x0000000002726000-memory.dmp

Filesize
408KB

Download
memory/3644-23-0x0000000004CA0000-0x0000000005244000-memory.dmp

Filesize
5.6MB

Download
memory/3644-24-0x0000000005250000-0x00000000052B6000-memory.dmp

Filesize
408KB

Download
memory/3644-28-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-42-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-88-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-84-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-82-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-80-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-78-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-76-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-74-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-70-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-68-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-66-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-64-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-62-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-60-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-56-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-54-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-52-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-50-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-48-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-46-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-45-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-40-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-38-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-36-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-34-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-32-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-30-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-86-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-72-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-58-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-26-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-25-0x0000000005250000-0x00000000052AF000-memory.dmp

Filesize
380KB

Download
memory/3644-2105-0x0000000005420000-0x0000000005452000-memory.dmp

Filesize
200KB

Download
memory/3660-2118-0x0000000000350000-0x0000000000380000-memory.dmp

Filesize
192KB

Download
memory/3660-2119-0x0000000000C90000-0x0000000000C96000-memory.dmp

Filesize
24KB

Download
memory/3660-2120-0x0000000005370000-0x0000000005988000-memory.dmp

Filesize
6.1MB

Download
memory/3660-2121-0x0000000004E60000-0x0000000004F6A000-memory.dmp

Filesize
1.0MB

Download
memory/3660-2122-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Filesize
72KB

Download
memory/3660-2123-0x0000000004D50000-0x0000000004D8C000-memory.dmp

Filesize
240KB

Download
memory/3660-2124-0x0000000004D90000-0x0000000004DDC000-memory.dmp

Filesize
304KB

Download
memory/6048-2129-0x00000000008B0000-0x00000000008DE000-memory.dmp

Filesize
184KB

Download
memory/6048-2130-0x00000000010D0000-0x00000000010D6000-memory.dmp

Filesize
24KB

Download