healer | 96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe
Size

654KB
MD5

f4fd4efadce779e50b91c8d98e246b6e
SHA1

0c0055fd3d4298bf8549ba09a5b2347a0fd93f50
SHA256

96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0
SHA512

23d4dd4120e0503c367c46e13fb1314e6013d2b5c7823184ac739176f72c56ace8271b1a8c21a1f0b8fa539595addc424776d40f0ecebce388781a0d9e440c14
SSDEEP

12288:WMrhy90TfFpSDKECrVTt49T5Cukwd+wTOoZHZPgF0fSueH+7:/yFDVZmwd+6OolZPIQ

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr453006.exe	healer
behavioral1/memory/3200-15-0x0000000000B10000-0x0000000000B1A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr453006.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr453006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr453006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr453006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr453006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr453006.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr453006.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2164-2105-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/6004-2119-0x00000000002F0000-0x0000000000320000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr941669.exe	family_redline
behavioral1/memory/1072-2130-0x0000000000740000-0x000000000076E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku544902.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	ku544902.exe

Executes dropped EXE 5 IoCs

Processes:

ziCK2518.exejr453006.exeku544902.exe1.exelr941669.exe

pid process

4176 ziCK2518.exe
3200 jr453006.exe
2164 ku544902.exe
6004 1.exe
1072 lr941669.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr453006.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr453006.exe

pid	process
4176	ziCK2518.exe
3200	jr453006.exe
2164	ku544902.exe
6004	1.exe
1072	lr941669.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr453006.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exeziCK2518.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziCK2518.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

6028 2164 WerFault.exe ku544902.exe

pid	pid_target	process	target process
6028	2164	WerFault.exe	ku544902.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1.exelr941669.exe96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exeziCK2518.exeku544902.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr941669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziCK2518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku544902.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr453006.exe

pid process

3200 jr453006.exe
3200 jr453006.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr453006.exeku544902.exe

description pid process

Token: SeDebugPrivilege 3200 jr453006.exe
Token: SeDebugPrivilege 2164 ku544902.exe

pid	process
3200	jr453006.exe
3200	jr453006.exe

description	pid	process
Token: SeDebugPrivilege	3200	jr453006.exe
Token: SeDebugPrivilege	2164	ku544902.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exeziCK2518.exeku544902.exe

description	pid	process	target process
PID 4044 wrote to memory of 4176	4044	96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe	ziCK2518.exe
PID 4044 wrote to memory of 4176	4044	96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe	ziCK2518.exe
PID 4044 wrote to memory of 4176	4044	96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe	ziCK2518.exe
PID 4176 wrote to memory of 3200	4176	ziCK2518.exe	jr453006.exe
PID 4176 wrote to memory of 3200	4176	ziCK2518.exe	jr453006.exe
PID 4176 wrote to memory of 2164	4176	ziCK2518.exe	ku544902.exe
PID 4176 wrote to memory of 2164	4176	ziCK2518.exe	ku544902.exe
PID 4176 wrote to memory of 2164	4176	ziCK2518.exe	ku544902.exe
PID 2164 wrote to memory of 6004	2164	ku544902.exe	1.exe
PID 2164 wrote to memory of 6004	2164	ku544902.exe	1.exe
PID 2164 wrote to memory of 6004	2164	ku544902.exe	1.exe
PID 4044 wrote to memory of 1072	4044	96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe	lr941669.exe
PID 4044 wrote to memory of 1072	4044	96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe	lr941669.exe
PID 4044 wrote to memory of 1072	4044	96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe	lr941669.exe

C:\Users\Admin\AppData\Local\Temp\96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe
"C:\Users\Admin\AppData\Local\Temp\96cda38a947f9ccea640fdd6aabd3e13b4edc0a3725e8113ad71083ebab95bc0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCK2518.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCK2518.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr453006.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr453006.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku544902.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku544902.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 1376
4⤵
- Program crash
PID:6028

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr941669.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr941669.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2164 -ip 2164
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr941669.exe

Filesize
168KB

MD5
049137450fceeb03a695c655831acfe3

SHA1
a998682ba98594c3cdfb071dce39e76e30a28d33

SHA256
91ab0a3f93c06433a4251b74a2d0f41e966ed63ed6432daec6a3fcb011b17762

SHA512
43fb3786e25ec8edd16e7d2d514980bccbc1a7ebac9bd4cff038d25ce4dc174de7c71fc1c6f0c997552fc52c3cf91e377ab05f0173b4f62c8f43a05c45eeb279

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCK2518.exe

Filesize
501KB

MD5
20c750b479ca640a46f644e8d82b3c60

SHA1
269787d2939960afe5f5ab9b2973ecc04f359f8a

SHA256
618544358172bab3a02d95a9115a39f7117e4ddef2f6b0ef1761ea1c88439d70

SHA512
9ce6eba7a1800f4e12bd7a32a156ca4b7377077d659c9c6c2d6cbda6365c748fbf409d2eaf01a07563326ae620eae31d5a2e537b28c1eaf7aab9837d2382334d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr453006.exe

Filesize
11KB

MD5
0aa92310553858d6b3a191e9e262d8cc

SHA1
1dd2c679388bb26f732b5e75b75aacc1762b919c

SHA256
6b25adb1a37407e00c108d97db627013c016f67c23a6d5ae4c638b91c618f1f0

SHA512
e6a44e2624033ecef97c888416aacb2ea18ef057de96681b965fc5c903eadcf47f1a4d47a02b01b8f04dc851c35c0eb9b5421e148dcb66d95795b5eeb180ea4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku544902.exe

Filesize
424KB

MD5
240e24f63903ca932715f963fedbd609

SHA1
5257626b514ac250cce5dfd1bae6c8041188cdc5

SHA256
5071a62f9895d43e8692e5011d9cbe9119d5a2c2aa2443facb69c20bf03c2d0f

SHA512
d086fac3c54188a5a2bf11ab171492dcbd7fcff5a244840f3fb8ed2bc505ac57a59c61551c238a479589e8e3512d4effde8eb07a687cf8213988f3414e638d4f

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1072-2131-0x0000000004F60000-0x0000000004F66000-memory.dmp

Filesize
24KB

Download
memory/1072-2130-0x0000000000740000-0x000000000076E000-memory.dmp

Filesize
184KB

Download
memory/2164-58-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-48-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-46-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-54-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-68-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-88-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-86-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-84-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-82-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-80-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-78-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-76-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-74-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-72-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-70-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-66-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-64-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-62-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-60-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-24-0x0000000005200000-0x0000000005266000-memory.dmp

Filesize
408KB

Download
memory/2164-56-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-52-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-50-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-44-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-42-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-40-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-38-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-32-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-30-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-28-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-26-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-36-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-35-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-25-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/2164-2105-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/2164-22-0x0000000004BA0000-0x0000000004C06000-memory.dmp

Filesize
408KB

Download
memory/2164-23-0x0000000004C10000-0x00000000051B4000-memory.dmp

Filesize
5.6MB

Download
memory/3200-16-0x00007FFB06E93000-0x00007FFB06E95000-memory.dmp

Filesize
8KB

Download
memory/3200-15-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Filesize
40KB

Download
memory/3200-14-0x00007FFB06E93000-0x00007FFB06E95000-memory.dmp

Filesize
8KB

Download
memory/6004-2119-0x00000000002F0000-0x0000000000320000-memory.dmp

Filesize
192KB

Download
memory/6004-2120-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Filesize
24KB

Download
memory/6004-2121-0x00000000052C0000-0x00000000058D8000-memory.dmp

Filesize
6.1MB

Download
memory/6004-2122-0x0000000004DB0000-0x0000000004EBA000-memory.dmp

Filesize
1.0MB

Download
memory/6004-2123-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/6004-2124-0x0000000004CE0000-0x0000000004D1C000-memory.dmp

Filesize
240KB

Download
memory/6004-2125-0x0000000004D20000-0x0000000004D6C000-memory.dmp

Filesize
304KB

Download