healer | e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe
Size

537KB
MD5

df7ef0f05b5588b463f4cd1225a9b6ef
SHA1

76954a45512e81ea98e69966fd99cb946ac97067
SHA256

e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0
SHA512

a9b4f22c1d180ee7af88b48011cff52c3f24f19d30cc9060d7f7a8e3c751b6244e2093b9f63ecce445b7f0910f7e7039141250fb7af50712ae83aeca21941177
SSDEEP

12288:SMrKy90OICUhj5JLgKwD7vVeP/UuAH+wH69qF+8J38:syaCOj5lgXDzVeP/aewxzJ38

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr117361.exe	healer
behavioral1/memory/2388-15-0x00000000005B0000-0x00000000005BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr117361.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr117361.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr117361.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr117361.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr117361.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr117361.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr117361.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5092-22-0x0000000004D60000-0x0000000004DA6000-memory.dmp	family_redline
behavioral1/memory/5092-24-0x00000000053D0000-0x0000000005414000-memory.dmp	family_redline
behavioral1/memory/5092-28-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-30-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-88-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-86-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-84-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-82-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-80-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-78-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-74-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-72-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-70-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-68-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-66-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-64-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-62-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-60-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-56-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-54-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-52-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-51-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-46-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-44-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-42-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-40-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-38-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-36-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-34-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-32-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-76-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-58-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-48-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-26-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline
behavioral1/memory/5092-25-0x00000000053D0000-0x000000000540F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

zizg9625.exejr117361.exeku932326.exe

pid process

2152 zizg9625.exe
2388 jr117361.exe
5092 ku932326.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr117361.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr117361.exe

pid	process
2152	zizg9625.exe
2388	jr117361.exe
5092	ku932326.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr117361.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exezizg9625.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zizg9625.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

zizg9625.exeku932326.exee5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zizg9625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku932326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr117361.exe

pid process

2388 jr117361.exe
2388 jr117361.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr117361.exeku932326.exe

description pid process

Token: SeDebugPrivilege 2388 jr117361.exe
Token: SeDebugPrivilege 5092 ku932326.exe

pid	process
2388	jr117361.exe
2388	jr117361.exe

description	pid	process
Token: SeDebugPrivilege	2388	jr117361.exe
Token: SeDebugPrivilege	5092	ku932326.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exezizg9625.exe

description	pid	process	target process
PID 1588 wrote to memory of 2152	1588	e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe	zizg9625.exe
PID 1588 wrote to memory of 2152	1588	e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe	zizg9625.exe
PID 1588 wrote to memory of 2152	1588	e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe	zizg9625.exe
PID 2152 wrote to memory of 2388	2152	zizg9625.exe	jr117361.exe
PID 2152 wrote to memory of 2388	2152	zizg9625.exe	jr117361.exe
PID 2152 wrote to memory of 5092	2152	zizg9625.exe	ku932326.exe
PID 2152 wrote to memory of 5092	2152	zizg9625.exe	ku932326.exe
PID 2152 wrote to memory of 5092	2152	zizg9625.exe	ku932326.exe

C:\Users\Admin\AppData\Local\Temp\e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe
"C:\Users\Admin\AppData\Local\Temp\e5665c809e8ced0ede0726b55483971883d500d7e7c9fb310820c16ab6a7d3c0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizg9625.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizg9625.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr117361.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr117361.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku932326.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku932326.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizg9625.exe

Filesize
395KB

MD5
0ff0bd8e0811c3427357753b7fec01ed

SHA1
4eea5c7c8e52e34cde96f4cfaa9e18c4910ffd77

SHA256
832b87dae7ce490df2917f070228bbe19c6f142abea0d5435686c1b655fb3fc4

SHA512
a743d1c835f68ba40a62eadbbafec742ba750c3c7cad60dc3bf594fd11b3f75504d3bf26d9128357960d1dd725b24ac2e6f21166babcaa8eec1971a4a4724d26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr117361.exe

Filesize
14KB

MD5
537eec419b792ad49b64a8e1ef7f3b41

SHA1
ce766a035848f7161c106bcf2310800237247d59

SHA256
e0efb5a8134b6c3cf3875b96fb5b44da0407af6dc84594c521d6c7f7f26d226e

SHA512
a99c4000b964f57cfa6bff8e464c1f266343e979bd7ea7b6cf0cc0666a96c678332b87b5b5392bc51b1776c389d6a6b16535d3ae291f466aab46f752f0ae5b93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku932326.exe

Filesize
352KB

MD5
8714f5d789fc6733fcd94f450ec7d394

SHA1
039aa4799f37c6ee0d70b96d3889e0eb20615bb5

SHA256
4729c59f8ef4cd16b6eb18df2a568621d0d0f003aabf13b72e7d856ad3cb989e

SHA512
f79edc926cd3d5fff33dec79e5eb5df6ce3c9d4022b74c1338f946f61c786f11fd43efbab1a7ddc7a2eca6d2a19a30ea66bb8c83042c6c02819f449b2f749a13

Download Submit
memory/2388-14-0x00007FFCA53A3000-0x00007FFCA53A5000-memory.dmp

Filesize
8KB

Download
memory/2388-15-0x00000000005B0000-0x00000000005BA000-memory.dmp

Filesize
40KB

Download
memory/2388-16-0x00007FFCA53A3000-0x00007FFCA53A5000-memory.dmp

Filesize
8KB

Download
memory/5092-64-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-52-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-24-0x00000000053D0000-0x0000000005414000-memory.dmp

Filesize
272KB

Download
memory/5092-28-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-30-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-88-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-86-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-84-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-82-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-80-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-78-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-74-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-72-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-70-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-68-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-66-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-22-0x0000000004D60000-0x0000000004DA6000-memory.dmp

Filesize
280KB

Download
memory/5092-62-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-60-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-56-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-54-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-23-0x0000000004DE0000-0x0000000005384000-memory.dmp

Filesize
5.6MB

Download
memory/5092-51-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-46-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-44-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-42-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-40-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-38-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-36-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-34-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-32-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-76-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-58-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-48-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-26-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-25-0x00000000053D0000-0x000000000540F000-memory.dmp

Filesize
252KB

Download
memory/5092-931-0x0000000005440000-0x0000000005A58000-memory.dmp

Filesize
6.1MB

Download
memory/5092-932-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

Filesize
1.0MB

Download
memory/5092-933-0x0000000005C20000-0x0000000005C32000-memory.dmp

Filesize
72KB

Download
memory/5092-934-0x0000000005D40000-0x0000000005D7C000-memory.dmp

Filesize
240KB

Download
memory/5092-935-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download