healer | fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exe
Size

524KB
MD5

fa3f59c48ef753498792885730e8547a
SHA1

7dcdb2496b8387c82440e6d4c0b1da327ab18d3c
SHA256

fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598
SHA512

fd70aa6b32d9f3fab7431e2bf7aa790a08454764e9cd50ab40d2899d5c36d7221a07f272e6c75b49e5a238e1eeb9fa73adc336e590877edf7aaf02d5aff85c92
SSDEEP

6144:KGy+bnr+3p0yN90QEtQrWeb+a0nTrVb8Dh34XA1XLGq0+oKWmUZmHFQo5nSqHOhh:iMrry90H5RneKQl6qgFmW0QcPqP

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr384187.exe	healer
behavioral1/memory/1208-15-0x0000000000350000-0x000000000035A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr384187.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr384187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr384187.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr384187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr384187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr384187.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr384187.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4020-22-0x00000000024C0000-0x0000000002506000-memory.dmp	family_redline
behavioral1/memory/4020-24-0x0000000004AA0000-0x0000000004AE4000-memory.dmp	family_redline
behavioral1/memory/4020-30-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-36-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-34-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-32-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-82-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-60-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-44-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-28-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-26-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-25-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-88-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-86-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-84-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-80-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-78-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-76-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-74-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-72-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-70-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-68-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-66-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-64-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-62-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-58-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-56-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-54-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-52-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-50-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-48-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-46-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-42-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-40-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline
behavioral1/memory/4020-38-0x0000000004AA0000-0x0000000004ADF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziNb1078.exejr384187.exeku912664.exe

pid process

4052 ziNb1078.exe
1208 jr384187.exe
4020 ku912664.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr384187.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr384187.exe

pid	process
4052	ziNb1078.exe
1208	jr384187.exe
4020	ku912664.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr384187.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exeziNb1078.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziNb1078.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exeziNb1078.exeku912664.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziNb1078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku912664.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr384187.exe

pid process

1208 jr384187.exe
1208 jr384187.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr384187.exeku912664.exe

description pid process

Token: SeDebugPrivilege 1208 jr384187.exe
Token: SeDebugPrivilege 4020 ku912664.exe

pid	process
1208	jr384187.exe
1208	jr384187.exe

description	pid	process
Token: SeDebugPrivilege	1208	jr384187.exe
Token: SeDebugPrivilege	4020	ku912664.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exeziNb1078.exe

description	pid	process	target process
PID 3168 wrote to memory of 4052	3168	fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exe	ziNb1078.exe
PID 3168 wrote to memory of 4052	3168	fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exe	ziNb1078.exe
PID 3168 wrote to memory of 4052	3168	fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exe	ziNb1078.exe
PID 4052 wrote to memory of 1208	4052	ziNb1078.exe	jr384187.exe
PID 4052 wrote to memory of 1208	4052	ziNb1078.exe	jr384187.exe
PID 4052 wrote to memory of 4020	4052	ziNb1078.exe	ku912664.exe
PID 4052 wrote to memory of 4020	4052	ziNb1078.exe	ku912664.exe
PID 4052 wrote to memory of 4020	4052	ziNb1078.exe	ku912664.exe

C:\Users\Admin\AppData\Local\Temp\fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exe
"C:\Users\Admin\AppData\Local\Temp\fd59415d0390240ef9895529d5973930e717009fc7dcbc1c32f4900f2f15d598.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3168

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNb1078.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNb1078.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr384187.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr384187.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku912664.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku912664.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNb1078.exe

Filesize
382KB

MD5
a7e9e7afad830cb1da583fda2b1aa4f7

SHA1
56bc8e3d43ce7a0892ac58d5729c801b880ea5ca

SHA256
0b739f03ea042b336fc7420ae7011785f6671f8e3e41fd90492231d638b59c6e

SHA512
86f7e832852436bfc96d44e6752300c7646d1e8a7e11b1cb25cbd9fe8f9b7cbdb8d87c5124ef5121e72b0049ca46112c9f4d3189291993b0e5f9d1107b88a345

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr384187.exe

Filesize
14KB

MD5
5bbb5f2a218dc52df31c2a795ea075c8

SHA1
bcff3ef8294a1435dd0210fa4798a19cbaf3eec8

SHA256
fc41b3837c1eda24c04e5aed30bd901f1b89cbba72b6418db0cda93a00ffa180

SHA512
324c75c4a36e50c5beb5e4c969c53ea307baa7174de4ee694df977b84c54d54709ac8c6b4854ecebba311464bc2bf2fbea0ae609e621148be9477a9c1722da4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku912664.exe

Filesize
295KB

MD5
a38dd1cf2070691ca3a6dfa63fe5b042

SHA1
97f479f826ff6bda59af0f5eae3293b93a8e6270

SHA256
5bbc286e430e27c0cc1154d5dce9971720f7e0dc4fb1fcc2330b273abd00f117

SHA512
111e9f938c69a6fbb8ffd11b16b190174e9622407a118b754af439e74d01f49e446da6dc8a2f2c4f3b01278a6f11af93245bdc9e46710b4b12aef7cb7440caa6

Download Submit
memory/1208-14-0x00007FFD35EB3000-0x00007FFD35EB5000-memory.dmp

Filesize
8KB

Download
memory/1208-15-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/1208-17-0x00007FFD35EB3000-0x00007FFD35EB5000-memory.dmp

Filesize
8KB

Download
memory/4020-80-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-70-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-24-0x0000000004AA0000-0x0000000004AE4000-memory.dmp

Filesize
272KB

Download
memory/4020-30-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-36-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-34-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-32-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-82-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-60-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-44-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-28-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-26-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-25-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-88-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-86-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-84-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-22-0x00000000024C0000-0x0000000002506000-memory.dmp

Filesize
280KB

Download
memory/4020-78-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-76-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-74-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-72-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-23-0x0000000004B60000-0x0000000005104000-memory.dmp

Filesize
5.6MB

Download
memory/4020-68-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-66-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-64-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-62-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-58-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-56-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-54-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-52-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-50-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-48-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-46-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-42-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-40-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-38-0x0000000004AA0000-0x0000000004ADF000-memory.dmp

Filesize
252KB

Download
memory/4020-931-0x0000000005110000-0x0000000005728000-memory.dmp

Filesize
6.1MB

Download
memory/4020-932-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/4020-933-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/4020-934-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/4020-935-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download