healer | d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exe
Size

537KB
MD5

4b200d16bd25374fe1642183cb66a138
SHA1

c68f7106ed8d79380259b78190593645ebdcf07f
SHA256

d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa
SHA512

3fc1d5f038ae790ef181a3161d6ebd21b8752becbd841364c726c36ed5c3d0c0451a9fb5350204a5ac1531324ce46fc33b27237827656852c6158ab368547688
SSDEEP

12288:7MrUy90Yz+4wN8g0ypLFTIEJFIRdGVawSWicyQ:zybzfwmgLpZTTJqqEZjS

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr144068.exe	healer
behavioral1/memory/1148-15-0x0000000000900000-0x000000000090A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr144068.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr144068.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr144068.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr144068.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr144068.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr144068.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr144068.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4824-22-0x0000000002460000-0x00000000024A6000-memory.dmp	family_redline
behavioral1/memory/4824-24-0x0000000002750000-0x0000000002794000-memory.dmp	family_redline
behavioral1/memory/4824-26-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-25-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-76-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-88-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-86-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-84-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-82-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-80-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-78-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-74-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-72-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-70-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-68-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-66-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-64-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-62-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-60-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-58-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-56-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-52-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-50-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-48-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-46-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-44-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-42-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-40-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-38-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-36-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-34-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-30-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-28-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-54-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline
behavioral1/memory/4824-32-0x0000000002750000-0x000000000278F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziAb1152.exejr144068.exeku442931.exe

pid process

1144 ziAb1152.exe
1148 jr144068.exe
4824 ku442931.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr144068.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr144068.exe

pid	process
1144	ziAb1152.exe
1148	jr144068.exe
4824	ku442931.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr144068.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exeziAb1152.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziAb1152.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4636 sc.exe

pid	process
4636	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exeziAb1152.exeku442931.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziAb1152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku442931.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr144068.exe

pid process

1148 jr144068.exe
1148 jr144068.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr144068.exeku442931.exe

description pid process

Token: SeDebugPrivilege 1148 jr144068.exe
Token: SeDebugPrivilege 4824 ku442931.exe

pid	process
1148	jr144068.exe
1148	jr144068.exe

description	pid	process
Token: SeDebugPrivilege	1148	jr144068.exe
Token: SeDebugPrivilege	4824	ku442931.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exeziAb1152.exe

description	pid	process	target process
PID 3648 wrote to memory of 1144	3648	d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exe	ziAb1152.exe
PID 3648 wrote to memory of 1144	3648	d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exe	ziAb1152.exe
PID 3648 wrote to memory of 1144	3648	d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exe	ziAb1152.exe
PID 1144 wrote to memory of 1148	1144	ziAb1152.exe	jr144068.exe
PID 1144 wrote to memory of 1148	1144	ziAb1152.exe	jr144068.exe
PID 1144 wrote to memory of 4824	1144	ziAb1152.exe	ku442931.exe
PID 1144 wrote to memory of 4824	1144	ziAb1152.exe	ku442931.exe
PID 1144 wrote to memory of 4824	1144	ziAb1152.exe	ku442931.exe

C:\Users\Admin\AppData\Local\Temp\d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exe
"C:\Users\Admin\AppData\Local\Temp\d75452bd4405230513b4229527c8c62966f42b2307b749a6a7a296b33add0efa.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAb1152.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAb1152.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr144068.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr144068.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku442931.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku442931.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAb1152.exe

Filesize
383KB

MD5
0334cf6a9bd5ae615a486bf9764ae0ef

SHA1
d23ebbede7159870bb66a04c68105a8402f384b8

SHA256
7af55cf00de8e8419df81269410cfe55f4b14aafadab61205a3c0a522c3cfca5

SHA512
50fb2f60d2cdfe58b23f78549dedf6750bae991cff6711083bf1e86c282f7102704a1b3ff86f3aebc0a104d42f0048f1229e3494874357078a1c19f3548a0597

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr144068.exe

Filesize
13KB

MD5
84bab76f53d09527ab0783ba2ece2e2e

SHA1
bfdc2db1addb613025d32d8a288fc7b70b8b22ee

SHA256
8f1eae62ef850d5a0a78054f853cbbe4c3b547bfc34ee890746405cee8bbfe95

SHA512
45f0fa0cf107c116e6bd6e8145cfa5580cc007c3755e5b290f5aede15e195c83e296b90d4a6bbbbd619dfdb98168569c2efe8f2e4c9c5a7083a849ed65c670c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku442931.exe

Filesize
311KB

MD5
97b001fa1933c6f24dc0af0c463fb9eb

SHA1
1eb7a1468cf16260140633cf3f32e6f7fd9f6fad

SHA256
2de42fe20b11b7713899f0ffec2c4819850a0a585b2babc4a5e4dc69a0f25c67

SHA512
04db5e07c82469c7e4ebcd25113aeac67de05678bf82bd3ab42d483784a319559623b8bcf473c0cbfc812a82eb28b3f40f44180cb1a0b05134a7749cd87f38b2

Download Submit
memory/1148-14-0x00007FFD35C63000-0x00007FFD35C65000-memory.dmp

Filesize
8KB

Download
memory/1148-15-0x0000000000900000-0x000000000090A000-memory.dmp

Filesize
40KB

Download
memory/1148-16-0x00007FFD35C63000-0x00007FFD35C65000-memory.dmp

Filesize
8KB

Download
memory/4824-66-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-56-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-24-0x0000000002750000-0x0000000002794000-memory.dmp

Filesize
272KB

Download
memory/4824-26-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-25-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-76-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-88-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-86-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-84-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-82-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-80-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-78-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-74-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-72-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-70-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-68-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-22-0x0000000002460000-0x00000000024A6000-memory.dmp

Filesize
280KB

Download
memory/4824-64-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-62-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-60-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-58-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-23-0x0000000004CD0000-0x0000000005274000-memory.dmp

Filesize
5.6MB

Download
memory/4824-52-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-50-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-48-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-46-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-44-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-42-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-40-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-38-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-36-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-34-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-30-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-28-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-54-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-32-0x0000000002750000-0x000000000278F000-memory.dmp

Filesize
252KB

Download
memory/4824-931-0x0000000005280000-0x0000000005898000-memory.dmp

Filesize
6.1MB

Download
memory/4824-932-0x0000000004BB0000-0x0000000004CBA000-memory.dmp

Filesize
1.0MB

Download
memory/4824-933-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/4824-934-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/4824-935-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download