healer | df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe
Size

531KB
MD5

c22d1f44a4513a3eb51673e2451a5ecf
SHA1

2a4898937b1c8c82113d66f2947362a6de7b8083
SHA256

df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b
SHA512

b4bf936dcc4aac8edd47e7e67abc270f169955b67974398b7bf2d6d5d55f0ea5ff74c36ef704ccd3a0b60379902783409c01f5cf91d3e61997f7b308d1ce5308
SSDEEP

12288:rMrky90Il4WHPGtsxSupIuXPY2lioqWHpmBJ:LywW+hu+2Y2XTH8r

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr566068.exe	healer
behavioral1/memory/3904-15-0x0000000000D40000-0x0000000000D4A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr566068.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr566068.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr566068.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr566068.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr566068.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr566068.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr566068.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2988-22-0x0000000004290000-0x00000000042D6000-memory.dmp	family_redline
behavioral1/memory/2988-24-0x0000000004460000-0x00000000044A4000-memory.dmp	family_redline
behavioral1/memory/2988-30-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-40-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-88-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-84-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-82-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-80-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-78-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-76-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-74-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-72-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-70-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-68-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-66-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-64-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-60-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-58-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-56-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-54-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-52-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-50-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-48-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-44-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-42-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-38-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-36-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-34-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-32-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-86-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-62-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-46-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-28-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-26-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline
behavioral1/memory/2988-25-0x0000000004460000-0x000000000449F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziNC3606.exejr566068.exeku684831.exe

pid process

3692 ziNC3606.exe
3904 jr566068.exe
2988 ku684831.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr566068.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr566068.exe

pid	process
3692	ziNC3606.exe
3904	jr566068.exe
2988	ku684831.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr566068.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ziNC3606.exedf921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziNC3606.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exeziNC3606.exeku684831.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziNC3606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku684831.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr566068.exe

pid process

3904 jr566068.exe
3904 jr566068.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr566068.exeku684831.exe

description pid process

Token: SeDebugPrivilege 3904 jr566068.exe
Token: SeDebugPrivilege 2988 ku684831.exe

pid	process
3904	jr566068.exe
3904	jr566068.exe

description	pid	process
Token: SeDebugPrivilege	3904	jr566068.exe
Token: SeDebugPrivilege	2988	ku684831.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exeziNC3606.exe

description	pid	process	target process
PID 5024 wrote to memory of 3692	5024	df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe	ziNC3606.exe
PID 5024 wrote to memory of 3692	5024	df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe	ziNC3606.exe
PID 5024 wrote to memory of 3692	5024	df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe	ziNC3606.exe
PID 3692 wrote to memory of 3904	3692	ziNC3606.exe	jr566068.exe
PID 3692 wrote to memory of 3904	3692	ziNC3606.exe	jr566068.exe
PID 3692 wrote to memory of 2988	3692	ziNC3606.exe	ku684831.exe
PID 3692 wrote to memory of 2988	3692	ziNC3606.exe	ku684831.exe
PID 3692 wrote to memory of 2988	3692	ziNC3606.exe	ku684831.exe

C:\Users\Admin\AppData\Local\Temp\df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe
"C:\Users\Admin\AppData\Local\Temp\df921319002c4c71c156317358228f2e734a3897a3ed8b52eec5f66a4ba13f5b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNC3606.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNC3606.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr566068.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr566068.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku684831.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku684831.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNC3606.exe

Filesize
389KB

MD5
0dde09c73ff582eab60f8ee5c38e9ea4

SHA1
c6926210d30f69d3f867d1125acfe0633a71e7c1

SHA256
561e27dd54af9195a54ec49697ae9c3dddc5e55bf63b1c311088fada3c6c0f44

SHA512
87ebe67f9a2f6269f684e303f18d63aad6c91ef5302216c07b079032848e1a7c5a3d1ae2828750f3a548f284b70e1e699980d12413e482eadb4c0ed312be9849

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr566068.exe

Filesize
12KB

MD5
1dbec2a643194da5110e9f9f2affc653

SHA1
e7932bd5ff25c1b85f012cbcc6bdd4f44f7b1e12

SHA256
3322d0fa238a458ecbea96b32c9cc1023396d847b9cbf1e79389efd1b9bcc398

SHA512
0997c22d914459fbdb156cad19653e59ed6ac5780026eef226839afc82af47b48038fe9c5fbdde5b4c054e094f5fec92f5c3529809507b4e4b3380f10e0a52a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku684831.exe

Filesize
435KB

MD5
244a4926ecc249aac0cf97b194377f6e

SHA1
7d81dafd94a04efa006879ef10950e9e798b13dc

SHA256
036815c653f6b9f63480c2fba49791ae15f226e7cad870b710d664c23c6684a7

SHA512
c860050411bc2eb5ccda2b90351a32f6fbee11408f9cc0685841043295186c3265a704f119150a8530ea9dc953967426133900a58e95891f4ef3cca038532586

Download Submit
memory/2988-64-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-22-0x0000000004290000-0x00000000042D6000-memory.dmp

Filesize
280KB

Download
memory/2988-935-0x0000000007890000-0x00000000078DC000-memory.dmp

Filesize
304KB

Download
memory/2988-58-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-23-0x0000000006AB0000-0x0000000007054000-memory.dmp

Filesize
5.6MB

Download
memory/2988-24-0x0000000004460000-0x00000000044A4000-memory.dmp

Filesize
272KB

Download
memory/2988-30-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-40-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-88-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-84-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-60-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-80-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-56-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-76-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-74-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-72-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-70-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-68-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-66-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-934-0x0000000006A20000-0x0000000006A5C000-memory.dmp

Filesize
240KB

Download
memory/2988-82-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-933-0x0000000006A00000-0x0000000006A12000-memory.dmp

Filesize
72KB

Download
memory/2988-78-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-54-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-52-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-50-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-48-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-44-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-42-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-38-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-36-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-34-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-32-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-86-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-62-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-46-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-28-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-26-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-25-0x0000000004460000-0x000000000449F000-memory.dmp

Filesize
252KB

Download
memory/2988-931-0x0000000007060000-0x0000000007678000-memory.dmp

Filesize
6.1MB

Download
memory/2988-932-0x0000000007680000-0x000000000778A000-memory.dmp

Filesize
1.0MB

Download
memory/3904-16-0x00007FFDC0293000-0x00007FFDC0295000-memory.dmp

Filesize
8KB

Download
memory/3904-14-0x00007FFDC0293000-0x00007FFDC0295000-memory.dmp

Filesize
8KB

Download
memory/3904-15-0x0000000000D40000-0x0000000000D4A000-memory.dmp

Filesize
40KB

Download