healer | c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe
Size

684KB
MD5

3c11945431bf2580c3e53de04ab9c76f
SHA1

c023151155ab1e1436ea96aa6a23ff84361b82a7
SHA256

c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0
SHA512

1f227355acae06ba67d6e0ab880ab388e27a06c3cd53f1dde8ba0f7c548e080ac0b58c149fe61b7e8f8a40effc00b2cd6247c3d5389b3d0022537a65ca26d05c
SSDEEP

12288:GMrEy9066KLsWombpiWN2nk3oIB3FL+73/Mi5rXSLORSjIwJmcvTLRv:OyGKYWDpim4k3/Lw/tprcjNJmcvJ

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr050996.exe	healer
behavioral1/memory/1920-15-0x0000000000A20000-0x0000000000A2A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr050996.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr050996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr050996.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr050996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr050996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr050996.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr050996.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/784-2105-0x0000000005890000-0x00000000058C2000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/5172-2118-0x0000000000FF0000-0x0000000001020000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr992792.exe	family_redline
behavioral1/memory/3648-2129-0x0000000000920000-0x000000000094E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku793572.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	ku793572.exe

Executes dropped EXE 5 IoCs

Processes:

zipp3848.exejr050996.exeku793572.exe1.exelr992792.exe

pid process

3656 zipp3848.exe
1920 jr050996.exe
784 ku793572.exe
5172 1.exe
3648 lr992792.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr050996.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr050996.exe

pid	process
3656	zipp3848.exe
1920	jr050996.exe
784	ku793572.exe
5172	1.exe
3648	lr992792.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr050996.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exezipp3848.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zipp3848.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2996 784 WerFault.exe ku793572.exe

pid	pid_target	process	target process
2996	784	WerFault.exe	ku793572.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exezipp3848.exeku793572.exe1.exelr992792.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zipp3848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku793572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr992792.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr050996.exe

pid process

1920 jr050996.exe
1920 jr050996.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr050996.exeku793572.exe

description pid process

Token: SeDebugPrivilege 1920 jr050996.exe
Token: SeDebugPrivilege 784 ku793572.exe

pid	process
1920	jr050996.exe
1920	jr050996.exe

description	pid	process
Token: SeDebugPrivilege	1920	jr050996.exe
Token: SeDebugPrivilege	784	ku793572.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exezipp3848.exeku793572.exe

description	pid	process	target process
PID 5108 wrote to memory of 3656	5108	c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe	zipp3848.exe
PID 5108 wrote to memory of 3656	5108	c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe	zipp3848.exe
PID 5108 wrote to memory of 3656	5108	c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe	zipp3848.exe
PID 3656 wrote to memory of 1920	3656	zipp3848.exe	jr050996.exe
PID 3656 wrote to memory of 1920	3656	zipp3848.exe	jr050996.exe
PID 3656 wrote to memory of 784	3656	zipp3848.exe	ku793572.exe
PID 3656 wrote to memory of 784	3656	zipp3848.exe	ku793572.exe
PID 3656 wrote to memory of 784	3656	zipp3848.exe	ku793572.exe
PID 784 wrote to memory of 5172	784	ku793572.exe	1.exe
PID 784 wrote to memory of 5172	784	ku793572.exe	1.exe
PID 784 wrote to memory of 5172	784	ku793572.exe	1.exe
PID 5108 wrote to memory of 3648	5108	c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe	lr992792.exe
PID 5108 wrote to memory of 3648	5108	c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe	lr992792.exe
PID 5108 wrote to memory of 3648	5108	c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe	lr992792.exe

C:\Users\Admin\AppData\Local\Temp\c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe
"C:\Users\Admin\AppData\Local\Temp\c1cec33e84ebf131caa7879479a0ab179fbb272136fe64ee218857dc3e9f3ca0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipp3848.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipp3848.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr050996.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr050996.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku793572.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku793572.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 1384
4⤵
- Program crash
PID:2996

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr992792.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr992792.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 784 -ip 784
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr992792.exe

Filesize
169KB

MD5
18e7f7dc262131b90f467aae99902671

SHA1
a2789bc5368171c6330f8d1fada0589188eae8f9

SHA256
22eaa841a1dfa6a7223d6c2dfabcabcf798905cbda218cfa16e0cd7b6514bc07

SHA512
16620fa3d39e0831ddb234969eb069821b939bec15f3992897a52dd342d0e377e9489642e671be4fdf342d6b004ac154611d73a35146e7e37984192e0a036dbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipp3848.exe

Filesize
530KB

MD5
67acd9fb637654f243de651ab73b2673

SHA1
8093e0c84c19ada042349d4233c1ae0cb0cfecb9

SHA256
c0518080bbe94b8e19e9453ac00314085dbbd01c7defdfbecbea5fd22285c0a4

SHA512
adddb6353dec38158f2bcd40ceaf57a0b871a44420559b01e393f8fdbfa4bf2a926dd80e5d64ab697aeb80fd3182240e3b2e696afcabdc54dcc69934928873a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr050996.exe

Filesize
12KB

MD5
7dc774d346b9c0c00037515944927c8c

SHA1
f5bd791a37f401df4d03b9d757d62b79894f657e

SHA256
bf27954b5d4c0c1ca8c06d6da583a86cdc7f8aab44e06ca7b6aa5dbb65265d04

SHA512
ec8a4b09bd8987148bb8fb90c002c45e92c3190d01b13597424e168096a1d0999d0a714c96c3650f33ca66425553c79e11709b3f119d8bd297108e9a8b62f691

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku793572.exe

Filesize
495KB

MD5
816b2fd4a25773f3390173833cfa16b5

SHA1
d28387c7170812ea587c9490cce817a8c4c6c336

SHA256
3a40efae1bf1c3ae89c85be0ef9568cff1c9054456321ce9a97273dbaad073c4

SHA512
18f0de4bd875084fd58eb7d711345b4538aba55a0b0e9d126e9741bc5938719f9a431fe4ec6ea3efd685d2dd6c97f8edebef26fb3a2631604c82a2c12ce6490a

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/784-48-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-84-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-24-0x0000000005670000-0x00000000056D6000-memory.dmp

Filesize
408KB

Download
memory/784-34-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-88-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-86-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-40-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-82-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-80-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-78-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-75-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-38-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-68-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-66-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-64-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-62-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-60-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-58-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-56-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-54-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-42-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-22-0x0000000002960000-0x00000000029C6000-memory.dmp

Filesize
408KB

Download
memory/784-47-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-44-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-50-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-23-0x00000000050C0000-0x0000000005664000-memory.dmp

Filesize
5.6MB

Download
memory/784-70-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-36-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-32-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-30-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-76-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-72-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-28-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-52-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-26-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-25-0x0000000005670000-0x00000000056CF000-memory.dmp

Filesize
380KB

Download
memory/784-2105-0x0000000005890000-0x00000000058C2000-memory.dmp

Filesize
200KB

Download
memory/1920-14-0x00007FFC27673000-0x00007FFC27675000-memory.dmp

Filesize
8KB

Download
memory/1920-15-0x0000000000A20000-0x0000000000A2A000-memory.dmp

Filesize
40KB

Download
memory/1920-16-0x00007FFC27673000-0x00007FFC27675000-memory.dmp

Filesize
8KB

Download
memory/3648-2129-0x0000000000920000-0x000000000094E000-memory.dmp

Filesize
184KB

Download
memory/3648-2130-0x0000000005140000-0x0000000005146000-memory.dmp

Filesize
24KB

Download
memory/5172-2118-0x0000000000FF0000-0x0000000001020000-memory.dmp

Filesize
192KB

Download
memory/5172-2119-0x00000000030C0000-0x00000000030C6000-memory.dmp

Filesize
24KB

Download
memory/5172-2120-0x0000000005FE0000-0x00000000065F8000-memory.dmp

Filesize
6.1MB

Download
memory/5172-2121-0x0000000005AD0000-0x0000000005BDA000-memory.dmp

Filesize
1.0MB

Download
memory/5172-2122-0x0000000005960000-0x0000000005972000-memory.dmp

Filesize
72KB

Download
memory/5172-2123-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/5172-2124-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download