healer | 017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe
Size

651KB
MD5

a8530fd087d5a258751fb49f2deaaf4e
SHA1

646eb43c1555db33d48adf67b52054b90518e40e
SHA256

017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13
SHA512

80756f1f073a758addd0299a7f12729feed2430265e274e4db59cde4bc038be7c1abd4e1995a70b95a2d662c0e9f995a2decb10b307e0156e30e0d62d67fae35
SSDEEP

12288:IMr7y90d+REC0v7TenRWJptEmbQZO83npgGtqGr8Xf5vr:jyrRzM7TKcJrEp6GBif5j

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr014625.exe	healer
behavioral1/memory/3596-15-0x00000000008F0000-0x00000000008FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr014625.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr014625.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr014625.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr014625.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr014625.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr014625.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr014625.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4484-2105-0x0000000005540000-0x0000000005572000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/708-2118-0x0000000000930000-0x0000000000960000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr597294.exe	family_redline
behavioral1/memory/1252-2129-0x00000000005B0000-0x00000000005DE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku800093.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	ku800093.exe

Executes dropped EXE 5 IoCs

Processes:

ziEr9590.exejr014625.exeku800093.exe1.exelr597294.exe

pid process

3044 ziEr9590.exe
3596 jr014625.exe
4484 ku800093.exe
708 1.exe
1252 lr597294.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr014625.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr014625.exe

pid	process
3044	ziEr9590.exe
3596	jr014625.exe
4484	ku800093.exe
708	1.exe
1252	lr597294.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr014625.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exeziEr9590.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziEr9590.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

692 4484 WerFault.exe ku800093.exe

pid	pid_target	process	target process
692	4484	WerFault.exe	ku800093.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exeziEr9590.exeku800093.exe1.exelr597294.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziEr9590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku800093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr597294.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr014625.exe

pid process

3596 jr014625.exe
3596 jr014625.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr014625.exeku800093.exe

description pid process

Token: SeDebugPrivilege 3596 jr014625.exe
Token: SeDebugPrivilege 4484 ku800093.exe

pid	process
3596	jr014625.exe
3596	jr014625.exe

description	pid	process
Token: SeDebugPrivilege	3596	jr014625.exe
Token: SeDebugPrivilege	4484	ku800093.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exeziEr9590.exeku800093.exe

description	pid	process	target process
PID 4884 wrote to memory of 3044	4884	017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe	ziEr9590.exe
PID 4884 wrote to memory of 3044	4884	017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe	ziEr9590.exe
PID 4884 wrote to memory of 3044	4884	017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe	ziEr9590.exe
PID 3044 wrote to memory of 3596	3044	ziEr9590.exe	jr014625.exe
PID 3044 wrote to memory of 3596	3044	ziEr9590.exe	jr014625.exe
PID 3044 wrote to memory of 4484	3044	ziEr9590.exe	ku800093.exe
PID 3044 wrote to memory of 4484	3044	ziEr9590.exe	ku800093.exe
PID 3044 wrote to memory of 4484	3044	ziEr9590.exe	ku800093.exe
PID 4484 wrote to memory of 708	4484	ku800093.exe	1.exe
PID 4484 wrote to memory of 708	4484	ku800093.exe	1.exe
PID 4484 wrote to memory of 708	4484	ku800093.exe	1.exe
PID 4884 wrote to memory of 1252	4884	017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe	lr597294.exe
PID 4884 wrote to memory of 1252	4884	017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe	lr597294.exe
PID 4884 wrote to memory of 1252	4884	017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe	lr597294.exe

C:\Users\Admin\AppData\Local\Temp\017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe
"C:\Users\Admin\AppData\Local\Temp\017671dcac1cac669ed6f943cbc3b2ee147bb045c047e703fbfbfef298f01b13.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziEr9590.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziEr9590.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr014625.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr014625.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku800093.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku800093.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 1192
4⤵
- Program crash
PID:692

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr597294.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr597294.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4484 -ip 4484
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr597294.exe

Filesize
168KB

MD5
88bbdf7c8eaf71ce7eb5e81a94883144

SHA1
3dd8dcb32348eadcde80c8c52199dc0e889c467d

SHA256
072c38eb2f0d5571c496b9662618d9c437f3526924333d17474643d9433eb213

SHA512
67a5f82491e41be00f089f92216a3b049c37201efed0ac30ed5908454a4f29b7632115219b6d97e87e240f4c4392007c93161c204ff149b74812b7a9db91cf1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziEr9590.exe

Filesize
497KB

MD5
1ca6037bf64c52a3863b4857a3d16b8d

SHA1
a4478a75e6e73f5b0e2793583adf6a14fd3bae08

SHA256
7656a1987e32a694a770abb938f73bc4c5cc5e1873bd67d370799311190d92cc

SHA512
3e5beaed80265738b26e70dac124511011748fd498d2155aa121717cccd98af5225becc83561c3918c5b4dfc38708d0c5f81a7fd7662f0a79d66cb7218e07ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr014625.exe

Filesize
11KB

MD5
5066675eeaa865c29e219ec2e8bf9b47

SHA1
0d55cc32b4c1e258085efe6f3b0074b9ebe53ef0

SHA256
d2565a07d0f9a9245adbb3c3ea344dd5e4c830a95bd1a30c4f3683f678b960dc

SHA512
a6fcf0627d23aa80c9fccb1d797b3db1c58eede8122d322588c6e6a5e9cff0cca7ca9f1e04c73dabb17df61a018a85ea793a42bb5c2b1ec92f7941ccf3282376

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku800093.exe

Filesize
415KB

MD5
78aa29f6aaa2ba9d1133bd3365215b37

SHA1
a7bf49432d5e972881d3f1a1e243251384f1b320

SHA256
1dee605c55eccfcac81a9af8d8782f55a7eeeda8d5cac9fa84eb6f26c99e58ec

SHA512
f53b76f5795b123849b066f5c85fbb010203de40064dc3879dfbcaf057688d27ac23a14908511ff913ac2d76d10aa3fa5003669bdd7ca0f096d6deb28d048280

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/708-2118-0x0000000000930000-0x0000000000960000-memory.dmp

Filesize
192KB

Download
memory/708-2120-0x00000000058B0000-0x0000000005EC8000-memory.dmp

Filesize
6.1MB

Download
memory/708-2119-0x00000000029E0000-0x00000000029E6000-memory.dmp

Filesize
24KB

Download
memory/708-2124-0x00000000054B0000-0x00000000054FC000-memory.dmp

Filesize
304KB

Download
memory/708-2123-0x0000000005310000-0x000000000534C000-memory.dmp

Filesize
240KB

Download
memory/708-2122-0x00000000052B0000-0x00000000052C2000-memory.dmp

Filesize
72KB

Download
memory/708-2121-0x00000000053A0000-0x00000000054AA000-memory.dmp

Filesize
1.0MB

Download
memory/1252-2130-0x0000000000C20000-0x0000000000C26000-memory.dmp

Filesize
24KB

Download
memory/1252-2129-0x00000000005B0000-0x00000000005DE000-memory.dmp

Filesize
184KB

Download
memory/3596-14-0x00007FFB40D23000-0x00007FFB40D25000-memory.dmp

Filesize
8KB

Download
memory/3596-15-0x00000000008F0000-0x00000000008FA000-memory.dmp

Filesize
40KB

Download
memory/3596-16-0x00007FFB40D23000-0x00007FFB40D25000-memory.dmp

Filesize
8KB

Download
memory/4484-64-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-38-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-78-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-76-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-74-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-72-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-70-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-68-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-66-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-82-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-62-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-58-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-56-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-55-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-50-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-48-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-46-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-44-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-40-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-80-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-36-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-32-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-30-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-28-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-86-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-60-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-84-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-88-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-42-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-34-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-24-0x0000000005320000-0x0000000005386000-memory.dmp

Filesize
408KB

Download
memory/4484-23-0x0000000004D30000-0x00000000052D4000-memory.dmp

Filesize
5.6MB

Download
memory/4484-22-0x0000000004CC0000-0x0000000004D26000-memory.dmp

Filesize
408KB

Download
memory/4484-52-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-26-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-25-0x0000000005320000-0x000000000537F000-memory.dmp

Filesize
380KB

Download
memory/4484-2105-0x0000000005540000-0x0000000005572000-memory.dmp

Filesize
200KB

Download