healer | 3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exe
Size

533KB
MD5

cff92830194d5a8afc8483a1bb2075c1
SHA1

3e53e14283f7a1edb525289559d9f8bd93a59b36
SHA256

3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2
SHA512

40cb090bfb6f184c3c19d1566a26c3d547a3e68d5d81a5695a766b9d5f9e82b6121ee7414e7485e24ae8dd395fc420d3cce621c4f25306f4d5264c6ac7a0da9c
SSDEEP

12288:6MrSy90vvFO19cig9j7uGUC3LqH0nF28wBRd:EyQ0MiKuGUC3Gr1d

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442411.exe	healer
behavioral1/memory/1396-15-0x0000000000330000-0x000000000033A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr442411.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr442411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr442411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr442411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr442411.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr442411.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr442411.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4660-22-0x0000000006050000-0x0000000006096000-memory.dmp	family_redline
behavioral1/memory/4660-24-0x00000000060D0000-0x0000000006114000-memory.dmp	family_redline
behavioral1/memory/4660-30-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-38-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-88-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-84-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-82-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-81-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-78-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-76-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-74-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-72-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-70-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-68-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-66-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-64-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-60-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-58-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-56-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-54-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-52-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-50-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-48-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-44-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-42-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-40-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-36-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-34-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-32-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-86-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-62-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-46-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-28-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-26-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline
behavioral1/memory/4660-25-0x00000000060D0000-0x000000000610F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

zicB1038.exejr442411.exeku755616.exe

pid process

4620 zicB1038.exe
1396 jr442411.exe
4660 ku755616.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr442411.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr442411.exe

pid	process
4620	zicB1038.exe
1396	jr442411.exe
4660	ku755616.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr442411.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exezicB1038.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zicB1038.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

116 sc.exe

pid	process
116	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exezicB1038.exeku755616.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zicB1038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku755616.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr442411.exe

pid process

1396 jr442411.exe
1396 jr442411.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr442411.exeku755616.exe

description pid process

Token: SeDebugPrivilege 1396 jr442411.exe
Token: SeDebugPrivilege 4660 ku755616.exe

pid	process
1396	jr442411.exe
1396	jr442411.exe

description	pid	process
Token: SeDebugPrivilege	1396	jr442411.exe
Token: SeDebugPrivilege	4660	ku755616.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exezicB1038.exe

description	pid	process	target process
PID 4276 wrote to memory of 4620	4276	3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exe	zicB1038.exe
PID 4276 wrote to memory of 4620	4276	3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exe	zicB1038.exe
PID 4276 wrote to memory of 4620	4276	3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exe	zicB1038.exe
PID 4620 wrote to memory of 1396	4620	zicB1038.exe	jr442411.exe
PID 4620 wrote to memory of 1396	4620	zicB1038.exe	jr442411.exe
PID 4620 wrote to memory of 4660	4620	zicB1038.exe	ku755616.exe
PID 4620 wrote to memory of 4660	4620	zicB1038.exe	ku755616.exe
PID 4620 wrote to memory of 4660	4620	zicB1038.exe	ku755616.exe

C:\Users\Admin\AppData\Local\Temp\3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exe
"C:\Users\Admin\AppData\Local\Temp\3881a4bed1ca5f3005defcf17701ef410eaa25c9bf37608badc93d33ff561fc2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicB1038.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicB1038.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442411.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442411.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku755616.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku755616.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zicB1038.exe

Filesize
391KB

MD5
74cb5b639727f692d2e3adb727dcedb9

SHA1
aa4a8815d72aad52efc74770505b34a1e5d69dcb

SHA256
1d39485e55a0934f334ad0be099f619a32b192d8be23c6813eb6c036e0415343

SHA512
6ede5ee7948f6e91bbdd0cfdb28817232e0f9d8daa1e0e5b1ab48a03f93ec4936f307d0f4a647bc7c20002208f564e4e7b7896ec06e63c32a246ec0a248314ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr442411.exe

Filesize
11KB

MD5
c8a8cea45e9b40590620ed7be3a231aa

SHA1
104f68acbfb921ed2e7bf6fb35f427643e7bbc2c

SHA256
e8777b31dbbc5db5ca15255be6ba323e57a5ca6eefe1f775d35bb05925af4aa1

SHA512
c59e0d5da5c966524f2370a5877212a3cfc9fc628ac7a09608bac67a13e5325c3858e50131fa4e0b1e6cdc036e48c481d40cfceeebf5cc52ab050ca1ff77f7d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku755616.exe

Filesize
359KB

MD5
2fc78408e42248d2d4b9f5b9b617ca64

SHA1
599705ea37458bdb536cf2b5937cd7b9b0a26e8e

SHA256
ade266ecb11733fc671adf280deca4a9ba04b6c2104a3f19f5867530acc99de0

SHA512
9da6fa138086b005560b5f1a269934df8892dfdd22c623be575849cda69bc47fe493bdae72d334d27ec5783e6e400f28f0c6c2e2366e27f5d53d6afb3d0505fd

Download Submit
memory/1396-14-0x00007FFB65E53000-0x00007FFB65E55000-memory.dmp

Filesize
8KB

Download
memory/1396-15-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/1396-16-0x00007FFB65E53000-0x00007FFB65E55000-memory.dmp

Filesize
8KB

Download
memory/4660-64-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-52-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-24-0x00000000060D0000-0x0000000006114000-memory.dmp

Filesize
272KB

Download
memory/4660-30-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-38-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-88-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-84-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-82-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-81-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-78-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-76-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-74-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-72-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-70-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-68-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-66-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-22-0x0000000006050000-0x0000000006096000-memory.dmp

Filesize
280KB

Download
memory/4660-60-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-58-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-56-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-54-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-23-0x0000000006220000-0x00000000067C4000-memory.dmp

Filesize
5.6MB

Download
memory/4660-50-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-48-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-44-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-42-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-40-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-36-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-34-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-32-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-86-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-62-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-46-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-28-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-26-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-25-0x00000000060D0000-0x000000000610F000-memory.dmp

Filesize
252KB

Download
memory/4660-931-0x00000000067D0000-0x0000000006DE8000-memory.dmp

Filesize
6.1MB

Download
memory/4660-932-0x0000000006DF0000-0x0000000006EFA000-memory.dmp

Filesize
1.0MB

Download
memory/4660-933-0x0000000006F10000-0x0000000006F22000-memory.dmp

Filesize
72KB

Download
memory/4660-934-0x0000000006F30000-0x0000000006F6C000-memory.dmp

Filesize
240KB

Download
memory/4660-935-0x0000000007080000-0x00000000070CC000-memory.dmp

Filesize
304KB

Download