healer | 20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exe
Size

537KB
MD5

f0bb98ec0d8981d0e58719bdbc49e812
SHA1

d29e783258a5e6ed226a5d5b4a9b8d17697acb62
SHA256

20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b
SHA512

f0afee042926028a9aaa368fc9f716c16fdcad6e8f4b2f6fc078807c67f99ff8170aa33c0a7e04fea4b119ced5fb61af39615f9ab46601f716e31981cf3e4ea4
SSDEEP

12288:vMrqy90OEksjeahZNkgzede8QSzdUQlHowQkgBnS3bEXWc:dy1Eksjbr8JdvIwLsS3bEXWc

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr771252.exe	healer
behavioral1/memory/3260-15-0x00000000001E0000-0x00000000001EA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr771252.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr771252.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr771252.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr771252.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr771252.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr771252.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr771252.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3120-22-0x0000000002720000-0x0000000002766000-memory.dmp	family_redline
behavioral1/memory/3120-24-0x00000000029E0000-0x0000000002A24000-memory.dmp	family_redline
behavioral1/memory/3120-32-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-46-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-88-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-86-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-84-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-82-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-80-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-78-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-76-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-74-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-72-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-70-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-68-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-66-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-64-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-62-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-60-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-56-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-55-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-52-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-50-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-48-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-44-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-42-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-40-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-38-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-36-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-34-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-58-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-30-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-28-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-26-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/3120-25-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

ziQD3831.exejr771252.exeku137545.exe

pid process

3544 ziQD3831.exe
3260 jr771252.exe
3120 ku137545.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr771252.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr771252.exe

pid	process
3544	ziQD3831.exe
3260	jr771252.exe
3120	ku137545.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr771252.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exeziQD3831.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziQD3831.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exeziQD3831.exeku137545.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziQD3831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku137545.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr771252.exe

pid process

3260 jr771252.exe
3260 jr771252.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr771252.exeku137545.exe

description pid process

Token: SeDebugPrivilege 3260 jr771252.exe
Token: SeDebugPrivilege 3120 ku137545.exe

pid	process
3260	jr771252.exe
3260	jr771252.exe

description	pid	process
Token: SeDebugPrivilege	3260	jr771252.exe
Token: SeDebugPrivilege	3120	ku137545.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exeziQD3831.exe

description	pid	process	target process
PID 1832 wrote to memory of 3544	1832	20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exe	ziQD3831.exe
PID 1832 wrote to memory of 3544	1832	20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exe	ziQD3831.exe
PID 1832 wrote to memory of 3544	1832	20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exe	ziQD3831.exe
PID 3544 wrote to memory of 3260	3544	ziQD3831.exe	jr771252.exe
PID 3544 wrote to memory of 3260	3544	ziQD3831.exe	jr771252.exe
PID 3544 wrote to memory of 3120	3544	ziQD3831.exe	ku137545.exe
PID 3544 wrote to memory of 3120	3544	ziQD3831.exe	ku137545.exe
PID 3544 wrote to memory of 3120	3544	ziQD3831.exe	ku137545.exe

C:\Users\Admin\AppData\Local\Temp\20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exe
"C:\Users\Admin\AppData\Local\Temp\20443c56de8e9a17017e8874561cae1fe63c39aa7c2202f8b8230e2caa040f4b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQD3831.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQD3831.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr771252.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr771252.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku137545.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku137545.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQD3831.exe

Filesize
395KB

MD5
459ec57cdbef693dfd79327748a477ba

SHA1
3c7831f2bf402c2af944da364cce911cedefbb85

SHA256
5b5cceab625cdd040e71010969167bf0fed9fa77afd50c2579d8f7a7c695a370

SHA512
328b38da5e592cf9d29129ba63d7b5c2c86264833525dba80dc74151bb8fd1273a42df987c3f032da1ec2d2ab3580e9d9ca90784b9ab2b0148ac4e5df9ac399f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr771252.exe

Filesize
13KB

MD5
aaf6b2789f35078e79e790a47f4ca9e1

SHA1
da53df13eae11a065840d9f6d22d0d87b80092f5

SHA256
cf78d8173926035b980dabb4cf474206ab90b822e0b600ca19949402640f3206

SHA512
3151835cbab306a05333b702a7ecddcba0dd98e62fde40daa20d8dd15afa3467dd391dafca373e700e6a54921c5d8dd53fef59500453002d894e538b91a37666

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku137545.exe

Filesize
352KB

MD5
308d43a0d115a8ffea09e239eac6ade3

SHA1
6c5914abe5e29218a77a623a76570e3816ed734a

SHA256
3c477c99ca89ade127bf838cd9030c71962bd4472f0c5d24427c1a4a9f8c6556

SHA512
2055b3aa252c22e8803f400d51b51017a15fce324e84d2a7cce3f24d59054d8b8ddf1a8a9d86725aada38ad223a7fc8138656713dc387d6fba5bd5bf5a44cdb3

Download Submit
memory/3120-66-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-22-0x0000000002720000-0x0000000002766000-memory.dmp

Filesize
280KB

Download
memory/3120-935-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/3120-62-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-23-0x00000000050C0000-0x0000000005664000-memory.dmp

Filesize
5.6MB

Download
memory/3120-24-0x00000000029E0000-0x0000000002A24000-memory.dmp

Filesize
272KB

Download
memory/3120-32-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-46-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-88-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-86-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-64-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-82-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-60-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-78-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-76-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-74-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-72-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-70-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-68-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-934-0x0000000005060000-0x000000000509C000-memory.dmp

Filesize
240KB

Download
memory/3120-84-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-933-0x0000000005040000-0x0000000005052000-memory.dmp

Filesize
72KB

Download
memory/3120-80-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-56-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-55-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-52-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-50-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-48-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-44-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-42-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-40-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-38-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-36-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-34-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-58-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-30-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-28-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-26-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-25-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/3120-931-0x0000000005670000-0x0000000005C88000-memory.dmp

Filesize
6.1MB

Download
memory/3120-932-0x0000000004F00000-0x000000000500A000-memory.dmp

Filesize
1.0MB

Download
memory/3260-16-0x00007FFD6CD13000-0x00007FFD6CD15000-memory.dmp

Filesize
8KB

Download
memory/3260-14-0x00007FFD6CD13000-0x00007FFD6CD15000-memory.dmp

Filesize
8KB

Download
memory/3260-15-0x00000000001E0000-0x00000000001EA000-memory.dmp

Filesize
40KB

Download