healer | c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe
Size

534KB
MD5

bebd3c09420a4190473fb9296cb16292
SHA1

fc793bd8526ed68a10bb2537daaaf602507c1c17
SHA256

c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd
SHA512

2b9bed9f7011c671f59f2d25b9c6005d0596d550bb23d657030589aeb22fa4f3b394a5baf4a7443da844d49be434b5d41d7cd0aec3202b71f9cb6fd286bf6e16
SSDEEP

6144:KTy+bnr+wp0yN90QEoOhzGWv8bD5xgZiImez4I5UOObwfu7+poCmeBfWRPb0JbwS:ZMr4y902IG2QGzz+bwWWotDG

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr913954.exe	healer
behavioral1/memory/32-15-0x0000000000370000-0x000000000037A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr913954.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr913954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr913954.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr913954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr913954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr913954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr913954.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2864-22-0x0000000002400000-0x0000000002446000-memory.dmp	family_redline
behavioral1/memory/2864-24-0x0000000004A90000-0x0000000004AD4000-memory.dmp	family_redline
behavioral1/memory/2864-34-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-38-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-86-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-84-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-82-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-80-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-78-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-76-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-72-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-70-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-68-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-66-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-64-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-60-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-56-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-54-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-52-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-51-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-46-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-44-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-42-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-40-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-36-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-32-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-30-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-88-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-74-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-58-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-48-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-28-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-26-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2864-25-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziwa8274.exejr913954.exeku691847.exe

pid process

2444 ziwa8274.exe
32 jr913954.exe
2864 ku691847.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr913954.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr913954.exe

pid	process
2444	ziwa8274.exe
32	jr913954.exe
2864	ku691847.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr913954.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ziwa8274.exec506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziwa8274.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ku691847.exec506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exeziwa8274.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku691847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziwa8274.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr913954.exe

pid process

32 jr913954.exe
32 jr913954.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr913954.exeku691847.exe

description pid process

Token: SeDebugPrivilege 32 jr913954.exe
Token: SeDebugPrivilege 2864 ku691847.exe

pid	process
32	jr913954.exe
32	jr913954.exe

description	pid	process
Token: SeDebugPrivilege	32	jr913954.exe
Token: SeDebugPrivilege	2864	ku691847.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exeziwa8274.exe

description	pid	process	target process
PID 4812 wrote to memory of 2444	4812	c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe	ziwa8274.exe
PID 4812 wrote to memory of 2444	4812	c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe	ziwa8274.exe
PID 4812 wrote to memory of 2444	4812	c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe	ziwa8274.exe
PID 2444 wrote to memory of 32	2444	ziwa8274.exe	jr913954.exe
PID 2444 wrote to memory of 32	2444	ziwa8274.exe	jr913954.exe
PID 2444 wrote to memory of 2864	2444	ziwa8274.exe	ku691847.exe
PID 2444 wrote to memory of 2864	2444	ziwa8274.exe	ku691847.exe
PID 2444 wrote to memory of 2864	2444	ziwa8274.exe	ku691847.exe

C:\Users\Admin\AppData\Local\Temp\c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe
"C:\Users\Admin\AppData\Local\Temp\c506e6132c0ceca89e6e80b60c5bd0d9b3b0f0fd081dc552e026ec91d860c1bd.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwa8274.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwa8274.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr913954.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr913954.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku691847.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku691847.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwa8274.exe

Filesize
392KB

MD5
f1971f25884bc22e0202ec8c674aff20

SHA1
33bcc62522d6eb3c3a0f08480a7bbfe01ae6684c

SHA256
5bf9ee09ac6a4d238027c2bf4f9944039efe602a0a3af67c4bf1637412688144

SHA512
1a229d700612c274138a27c419e4febee7711eb55fd9a1a204ee7fe8054389c164a95477b21b5647513f2b1b54f3be80cb2eefeaeb34c09f270911417efeddf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr913954.exe

Filesize
12KB

MD5
fc9cd06d285ac45e9701c180584fdf8d

SHA1
13a389b36546df41ecdd9f2d48f521bc81ac9da4

SHA256
7229afcb98145a85a88395a4a8c658fae0546879fada6842bc6642f1d37586a7

SHA512
511e3fe4f1bcbcabac031aedea166fa61cb742549cddfc3c73d90fb833381713b2738bb9176a85dc1930e9295cbd71cb1d093e2b6a0824f9a636aa24e5879756

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku691847.exe

Filesize
319KB

MD5
54e927db4e48f8f250b9d03f4a34e1ee

SHA1
226d18c945aa4b5f9bf41db2bab25cc5a3815088

SHA256
71faef803c961374541a0b38521255580e04d2e04a7c08bec3efcf385ef36c9a

SHA512
afb8d32eafb691753bcaeeafe9d8bcc84f2ecd9717a2bdcc8d664a684c4b3824f11f3c036211cdc6dc84d777a329a03ed8312f781716d5e47e19642d2a10e060

Download Submit
memory/32-14-0x00007FFF8A863000-0x00007FFF8A865000-memory.dmp

Filesize
8KB

Download
memory/32-15-0x0000000000370000-0x000000000037A000-memory.dmp

Filesize
40KB

Download
memory/32-16-0x00007FFF8A863000-0x00007FFF8A865000-memory.dmp

Filesize
8KB

Download
memory/2864-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-51-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-24-0x0000000004A90000-0x0000000004AD4000-memory.dmp

Filesize
272KB

Download
memory/2864-34-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-38-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-86-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-84-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-82-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-80-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-78-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-76-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-72-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-70-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-68-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-66-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-64-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-22-0x0000000002400000-0x0000000002446000-memory.dmp

Filesize
280KB

Download
memory/2864-60-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-56-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-54-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-52-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-23-0x0000000004B70000-0x0000000005114000-memory.dmp

Filesize
5.6MB

Download
memory/2864-46-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-44-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-42-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-40-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-36-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-32-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-30-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-88-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-74-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-58-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-48-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-28-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-26-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-25-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2864-931-0x0000000005120000-0x0000000005738000-memory.dmp

Filesize
6.1MB

Download
memory/2864-932-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/2864-933-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/2864-934-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/2864-935-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download