healer | 46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exe
Size

533KB
MD5

38ced4b8464e2da0988aa2c6a354859e
SHA1

487859db5f406a41ac2822144ccb7d1e6f65f30a
SHA256

46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba
SHA512

222f3f341402c82c256a63332c9f48f585bedca8479c6df595f675b3e25e36c0135f50b2e19659b56ad5e1c542e45a31caaa512d4f449ea61e42b813f771f0e1
SSDEEP

12288:ZMroy90T66hZZBuSFasN02OU04hCGJ4/4Q9IR:JyJmZUSHbU4YGC/47

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr118214.exe	healer
behavioral1/memory/2352-15-0x0000000000B70000-0x0000000000B7A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr118214.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr118214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr118214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr118214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr118214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr118214.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr118214.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4488-22-0x0000000002690000-0x00000000026D6000-memory.dmp	family_redline
behavioral1/memory/4488-24-0x0000000004A80000-0x0000000004AC4000-memory.dmp	family_redline
behavioral1/memory/4488-38-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-40-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-88-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-86-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-82-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-80-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-78-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-76-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-74-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-72-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-70-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-68-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-66-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-64-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-60-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-58-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-56-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-55-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-52-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-50-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-48-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-46-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-44-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-42-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-36-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-34-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-32-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-30-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-84-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-62-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-28-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-26-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline
behavioral1/memory/4488-25-0x0000000004A80000-0x0000000004ABF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

zibR7846.exejr118214.exeku430018.exe

pid process

1656 zibR7846.exe
2352 jr118214.exe
4488 ku430018.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr118214.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr118214.exe

pid	process
1656	zibR7846.exe
2352	jr118214.exe
4488	ku430018.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr118214.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exezibR7846.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zibR7846.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ku430018.exe46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exezibR7846.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku430018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zibR7846.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr118214.exe

pid process

2352 jr118214.exe
2352 jr118214.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr118214.exeku430018.exe

description pid process

Token: SeDebugPrivilege 2352 jr118214.exe
Token: SeDebugPrivilege 4488 ku430018.exe

pid	process
2352	jr118214.exe
2352	jr118214.exe

description	pid	process
Token: SeDebugPrivilege	2352	jr118214.exe
Token: SeDebugPrivilege	4488	ku430018.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exezibR7846.exe

description	pid	process	target process
PID 3224 wrote to memory of 1656	3224	46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exe	zibR7846.exe
PID 3224 wrote to memory of 1656	3224	46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exe	zibR7846.exe
PID 3224 wrote to memory of 1656	3224	46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exe	zibR7846.exe
PID 1656 wrote to memory of 2352	1656	zibR7846.exe	jr118214.exe
PID 1656 wrote to memory of 2352	1656	zibR7846.exe	jr118214.exe
PID 1656 wrote to memory of 4488	1656	zibR7846.exe	ku430018.exe
PID 1656 wrote to memory of 4488	1656	zibR7846.exe	ku430018.exe
PID 1656 wrote to memory of 4488	1656	zibR7846.exe	ku430018.exe

C:\Users\Admin\AppData\Local\Temp\46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exe
"C:\Users\Admin\AppData\Local\Temp\46a607b6b078561ce860eb97bed73eb675489a0e2737ae81face8f5fea14b6ba.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibR7846.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibR7846.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr118214.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr118214.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku430018.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku430018.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zibR7846.exe

Filesize
380KB

MD5
bfcf3f4d67fbef37befcebfe7bec8ac1

SHA1
a136b733b8c9a2738773f3c19282f74b64d8ad80

SHA256
14c669168b8bda16c803925bab434ac0eeb584672f103bc8db256bc2157d8829

SHA512
e7f369a0444c401f4022ea2aa753c9e062f67736aed85c2ea47afa70dc7f2a511e31024ddf3aaa1dfb91dc4db2d4c9f7837bd05ead30877dc08ea23675a901f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr118214.exe

Filesize
15KB

MD5
988b128177178f73d52fcfdfdef60d22

SHA1
ca4bbf53d30e575f2dcd7bc6d8b4ba1f69024f06

SHA256
2e7cfd66436825c0effc4a08867ce9de6676a4d87d81fd501e049f6b2810ed4a

SHA512
156ae29b79c6124fb1ea89864d0b0c003f242348804aff985d558845d045871961a955a41bf77434ab215ede0a62e6bae19919f35ca3b679371cd8917fa880c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku430018.exe

Filesize
295KB

MD5
5d2bc3da2b0ba470d13d454ff854ac4d

SHA1
b4b0a1642b9c44c7cab8019c54e3f00dd2ed07b0

SHA256
d52cf488612fef5e24183947eba42030dad8a367fef2d71c70a1e9dba12540fb

SHA512
bfbe3c0a6daabf050a420052517c511f2e8db15b19779515a89b2022e7131c55ee1bc91480dd3978df4021b0b3b5b0a30e95faba1c6a1f95014efb52c97dca39

Download Submit
memory/2352-14-0x00007FF900DF3000-0x00007FF900DF5000-memory.dmp

Filesize
8KB

Download
memory/2352-15-0x0000000000B70000-0x0000000000B7A000-memory.dmp

Filesize
40KB

Download
memory/2352-16-0x00007FF900DF3000-0x00007FF900DF5000-memory.dmp

Filesize
8KB

Download
memory/4488-64-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-52-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-24-0x0000000004A80000-0x0000000004AC4000-memory.dmp

Filesize
272KB

Download
memory/4488-38-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-40-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-88-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-86-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-82-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-80-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-78-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-76-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-74-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-72-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-70-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-68-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-66-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-22-0x0000000002690000-0x00000000026D6000-memory.dmp

Filesize
280KB

Download
memory/4488-60-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-58-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-56-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-55-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-23-0x0000000004B60000-0x0000000005104000-memory.dmp

Filesize
5.6MB

Download
memory/4488-50-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-48-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-46-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-44-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-42-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-36-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-34-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-32-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-30-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-84-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-62-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-28-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-26-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-25-0x0000000004A80000-0x0000000004ABF000-memory.dmp

Filesize
252KB

Download
memory/4488-931-0x0000000005220000-0x0000000005838000-memory.dmp

Filesize
6.1MB

Download
memory/4488-932-0x00000000058C0000-0x00000000059CA000-memory.dmp

Filesize
1.0MB

Download
memory/4488-933-0x0000000005A00000-0x0000000005A12000-memory.dmp

Filesize
72KB

Download
memory/4488-934-0x0000000005A20000-0x0000000005A5C000-memory.dmp

Filesize
240KB

Download
memory/4488-935-0x0000000005B70000-0x0000000005BBC000-memory.dmp

Filesize
304KB

Download