healer | a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe
Size

559KB
MD5

60019f1a6d79db5ce56fdc1dc5fe5d58
SHA1

85ff2492a1e91e6be07e7bb4876f266dab8105d7
SHA256

a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed
SHA512

12b6301a071f9d555d49f1c2272d0f5b7388258d4350fb40ecb3f35b2c8049fbb0436f7b5929552c56929511757ff7f100ed189e21786e68657890c016d479ef
SSDEEP

12288:oMrby90DyioneBvmrm8aHVSTVbcRcERaz4CsXlC8:zyNiBvm67SVbdXkCi

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr748957.exe	healer
behavioral1/memory/2812-15-0x0000000000A00000-0x0000000000A0A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr748957.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr748957.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr748957.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr748957.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr748957.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr748957.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr748957.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4900-22-0x00000000028F0000-0x0000000002936000-memory.dmp	family_redline
behavioral1/memory/4900-24-0x0000000004E00000-0x0000000004E44000-memory.dmp	family_redline
behavioral1/memory/4900-40-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-30-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-26-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-25-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-48-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-89-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-85-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-62-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-60-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-58-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-56-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-52-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-50-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-46-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-44-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-42-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-38-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-36-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-34-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-32-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-28-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline
behavioral1/memory/4900-54-0x0000000004E00000-0x0000000004E3F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziVW9579.exejr748957.exeku982292.exe

pid process

4008 ziVW9579.exe
2812 jr748957.exe
4900 ku982292.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr748957.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr748957.exe

pid	process
4008	ziVW9579.exe
2812	jr748957.exe
4900	ku982292.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr748957.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ziVW9579.exea90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziVW9579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ziVW9579.exeku982292.exea90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziVW9579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku982292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr748957.exe

pid process

2812 jr748957.exe
2812 jr748957.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr748957.exeku982292.exe

description pid process

Token: SeDebugPrivilege 2812 jr748957.exe
Token: SeDebugPrivilege 4900 ku982292.exe

pid	process
2812	jr748957.exe
2812	jr748957.exe

description	pid	process
Token: SeDebugPrivilege	2812	jr748957.exe
Token: SeDebugPrivilege	4900	ku982292.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exeziVW9579.exe

description	pid	process	target process
PID 1176 wrote to memory of 4008	1176	a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe	ziVW9579.exe
PID 1176 wrote to memory of 4008	1176	a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe	ziVW9579.exe
PID 1176 wrote to memory of 4008	1176	a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe	ziVW9579.exe
PID 4008 wrote to memory of 2812	4008	ziVW9579.exe	jr748957.exe
PID 4008 wrote to memory of 2812	4008	ziVW9579.exe	jr748957.exe
PID 4008 wrote to memory of 4900	4008	ziVW9579.exe	ku982292.exe
PID 4008 wrote to memory of 4900	4008	ziVW9579.exe	ku982292.exe
PID 4008 wrote to memory of 4900	4008	ziVW9579.exe	ku982292.exe

C:\Users\Admin\AppData\Local\Temp\a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe
"C:\Users\Admin\AppData\Local\Temp\a90194e19551985c1a789c08ca8a3857ddaf4df916b190aeab5ada5daaf1f3ed.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVW9579.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVW9579.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4008

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr748957.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr748957.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku982292.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku982292.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVW9579.exe

Filesize
405KB

MD5
b01df9117d2980d98fb5b8e3ca37f82f

SHA1
0d18ad6989eceb309d554157f7f6edbdab6e7c85

SHA256
1f16022bcf98965952141dda29f6aebd967756c9387f537050fbc27fe8d8277b

SHA512
93a1b3afa8c7cd5b4239d7f1b53497513563f8ba702d6581768dd42feed0c6ee584ac65340d25dc9d0bc82df37c0832e4a5347c6a2228a51834d5287211861b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr748957.exe

Filesize
12KB

MD5
fa9903abc912758961625bf9a4ea3df3

SHA1
2f4c00bb09ff4274e3dc268c11a2c7276f9f2d86

SHA256
0a962f70fdaf02d6d60ee66a6df9c23c6fb6abca9945d02ef452fb6dc9549a66

SHA512
97053aefc06020f0e9673ef7ae0d77f1ec38ac372fd4960bd9ee71dca7d38396aa3f7b4177a2564a5df8c85d12d2d57619b92056dcbe054056acdc0e32c1f633

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku982292.exe

Filesize
370KB

MD5
e511e93cfa301f7bec9a8c4fbbc059cb

SHA1
957f9df3e14bfd900cc0443dfef2c75c3c3e0f56

SHA256
9f50fbb008f492becf48621769f9f4b6942f1d4bf48418bf34a1f0a3114ba347

SHA512
50839ca76d20ff1420f7cba00bbc5814d50342e328ea80bc56ae26155d08d2598b791e8980fda6f7fea947e6391b1fd96efa3b3218970db0f8b7baf01354a18c

Download Submit
memory/2812-14-0x00007FFF303D3000-0x00007FFF303D5000-memory.dmp

Filesize
8KB

Download
memory/2812-15-0x0000000000A00000-0x0000000000A0A000-memory.dmp

Filesize
40KB

Download
memory/2812-16-0x00007FFF303D3000-0x00007FFF303D5000-memory.dmp

Filesize
8KB

Download
memory/4900-72-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-62-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-24-0x0000000004E00000-0x0000000004E44000-memory.dmp

Filesize
272KB

Download
memory/4900-40-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-30-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-26-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-25-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-48-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-89-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-86-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-85-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-82-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-80-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-78-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-76-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-74-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-22-0x00000000028F0000-0x0000000002936000-memory.dmp

Filesize
280KB

Download
memory/4900-70-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-68-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-66-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-64-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-23-0x0000000004FA0000-0x0000000005544000-memory.dmp

Filesize
5.6MB

Download
memory/4900-60-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-58-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-56-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-52-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-50-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-46-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-44-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-42-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-38-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-36-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-34-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-32-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-28-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-54-0x0000000004E00000-0x0000000004E3F000-memory.dmp

Filesize
252KB

Download
memory/4900-931-0x0000000005550000-0x0000000005B68000-memory.dmp

Filesize
6.1MB

Download
memory/4900-932-0x0000000005B70000-0x0000000005C7A000-memory.dmp

Filesize
1.0MB

Download
memory/4900-933-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/4900-934-0x0000000005C80000-0x0000000005CBC000-memory.dmp

Filesize
240KB

Download
memory/4900-935-0x0000000005DC0000-0x0000000005E0C000-memory.dmp

Filesize
304KB

Download