healer | 0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exe
Size

530KB
MD5

a8725d27bf7b59a1ec0735209ff41f4b
SHA1

0841c8aea28949a2a60d46efb125ac40b2965015
SHA256

0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43
SHA512

ddc6ed6bea17856eafb14f247fe2a934524fcd97540066c7577525ef6d985b1e4a7a01c4f275ecf0ebbd131ae5c69b1c149988f44dda20b54719f437d13fd733
SSDEEP

12288:dMrky90n5a05+rd/0P9TpG111PV16jbfm:FygwR/0PdyvPV16jrm

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr745615.exe	healer
behavioral1/memory/5112-15-0x00000000000B0000-0x00000000000BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr745615.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr745615.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr745615.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr745615.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr745615.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr745615.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr745615.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2820-21-0x0000000002940000-0x0000000002986000-memory.dmp	family_redline
behavioral1/memory/2820-23-0x0000000005420000-0x0000000005464000-memory.dmp	family_redline
behavioral1/memory/2820-24-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-39-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-49-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-87-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-85-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-83-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-81-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-77-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-75-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-74-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-71-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-69-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-67-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-65-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-63-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-61-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-59-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-55-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-53-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-51-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-47-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-45-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-43-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-41-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-37-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-35-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-33-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-31-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-29-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-79-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-57-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-27-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline
behavioral1/memory/2820-25-0x0000000005420000-0x000000000545F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziZd5182.exejr745615.exeku772156.exe

pid process

4024 ziZd5182.exe
5112 jr745615.exe
2820 ku772156.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr745615.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr745615.exe

pid	process
4024	ziZd5182.exe
5112	jr745615.exe
2820	ku772156.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr745615.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exeziZd5182.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziZd5182.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exeziZd5182.exeku772156.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziZd5182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku772156.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr745615.exe

pid process

5112 jr745615.exe
5112 jr745615.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr745615.exeku772156.exe

description pid process

Token: SeDebugPrivilege 5112 jr745615.exe
Token: SeDebugPrivilege 2820 ku772156.exe

pid	process
5112	jr745615.exe
5112	jr745615.exe

description	pid	process
Token: SeDebugPrivilege	5112	jr745615.exe
Token: SeDebugPrivilege	2820	ku772156.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exeziZd5182.exe

description	pid	process	target process
PID 4108 wrote to memory of 4024	4108	0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exe	ziZd5182.exe
PID 4108 wrote to memory of 4024	4108	0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exe	ziZd5182.exe
PID 4108 wrote to memory of 4024	4108	0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exe	ziZd5182.exe
PID 4024 wrote to memory of 5112	4024	ziZd5182.exe	jr745615.exe
PID 4024 wrote to memory of 5112	4024	ziZd5182.exe	jr745615.exe
PID 4024 wrote to memory of 2820	4024	ziZd5182.exe	ku772156.exe
PID 4024 wrote to memory of 2820	4024	ziZd5182.exe	ku772156.exe
PID 4024 wrote to memory of 2820	4024	ziZd5182.exe	ku772156.exe

C:\Users\Admin\AppData\Local\Temp\0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exe
"C:\Users\Admin\AppData\Local\Temp\0df3b350b419160d759f577879e00417f1ca24198357d656883a1b88d1bc2a43.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZd5182.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZd5182.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4024

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr745615.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr745615.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku772156.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku772156.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZd5182.exe

Filesize
387KB

MD5
1b34f659beae4c8d5fd0ea7c698b855b

SHA1
51dfd69d7964bfae4d8410f7d8950c83b429394b

SHA256
0a610ccdad72f12e255c38b471179ee8afa0ee0ae3233636bd1dcb37205a3ffe

SHA512
217ba315d34469be6185b1b084ef1a33644ec166584281e27687a054ac13af77c605a0aad32db3df20bdfce632c90585b3f6418d46b4434312dafa82e7a535a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr745615.exe

Filesize
12KB

MD5
cea9b9dbeb7b69e04cf011e72a75c2d1

SHA1
3d4163afb1c2ecac4a09c395d707621eeedcc286

SHA256
0b9f4021e83d7da3c7506d28a1aaa8dce95728b6fd133b5565c9bd0e45636c89

SHA512
b0131bde853576fcddaaac2a0de217e562e6fb0c3bd9f36bc8dff8b8c097b5a99341049eb4d3c9f65b5dea428ecc938762913c6d3f4004d4cd993f26564f2d53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku772156.exe

Filesize
353KB

MD5
4e3fe03966ba5af9d13a2ea264b69d4b

SHA1
01a85e782a6637370cef3f016d5677edcd949200

SHA256
0e93f0490f9ca7c77a8f2c3141fc7a1c38dcfdaabbb6e60514821572e9bac62d

SHA512
d8545dc6a8ba13cad956cd55cb05f9f8a8252c2fe63fe3e6fc8e07c72992f008d1d63d8c92833908eda8989f70eaf93625bb40a3c847136eeb0f9a712113e9bc

Download Submit
memory/2820-63-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-22-0x0000000004E70000-0x0000000005414000-memory.dmp

Filesize
5.6MB

Download
memory/2820-21-0x0000000002940000-0x0000000002986000-memory.dmp

Filesize
280KB

Download
memory/2820-59-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-23-0x0000000005420000-0x0000000005464000-memory.dmp

Filesize
272KB

Download
memory/2820-24-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-39-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-49-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-87-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-85-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-83-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-81-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-77-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-75-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-74-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-55-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-69-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-67-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-65-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-934-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/2820-933-0x0000000005C40000-0x0000000005C7C000-memory.dmp

Filesize
240KB

Download
memory/2820-61-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-71-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-53-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-51-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-47-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-45-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-43-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-41-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-37-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-35-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-33-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-31-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-29-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-79-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-57-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-27-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-25-0x0000000005420000-0x000000000545F000-memory.dmp

Filesize
252KB

Download
memory/2820-930-0x0000000005460000-0x0000000005A78000-memory.dmp

Filesize
6.1MB

Download
memory/2820-931-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

Filesize
1.0MB

Download
memory/2820-932-0x0000000005C20000-0x0000000005C32000-memory.dmp

Filesize
72KB

Download
memory/5112-15-0x00000000000B0000-0x00000000000BA000-memory.dmp

Filesize
40KB

Download
memory/5112-14-0x00007FFEAF863000-0x00007FFEAF865000-memory.dmp

Filesize
8KB

Download