healer | 61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe
Size

651KB
MD5

42aceb33407ee99276fc54385c54cfdc
SHA1

ab4ed003d4cbf0c567614ecd96f5fad2ff10d49a
SHA256

61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630
SHA512

6acf719a505ebb2b841a4ac001f0a51e3f04cf8bcca5dc2a84a377055f7da941b64b19ba43dd3d460dcd24876a70530c58923a66227a698a6ced8855befa01a9
SSDEEP

12288:TMrzy90JaI8eVwC0LzKnr2u9aKoUzl631UqjQURuevXScSs:4ygbwC0LzKnyu9aKoUJ631D1umRSs

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr097743.exe	healer
behavioral1/memory/4900-15-0x0000000000370000-0x000000000037A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr097743.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr097743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr097743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr097743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr097743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr097743.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr097743.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1448-2105-0x0000000002790000-0x00000000027C2000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/1592-2118-0x0000000000390000-0x00000000003C0000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr255233.exe	family_redline
behavioral1/memory/4312-2129-0x0000000000C50000-0x0000000000C7E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku974967.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	ku974967.exe

Executes dropped EXE 5 IoCs

Processes:

ziuS8657.exejr097743.exeku974967.exe1.exelr255233.exe

pid process

2188 ziuS8657.exe
4900 jr097743.exe
1448 ku974967.exe
1592 1.exe
4312 lr255233.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr097743.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr097743.exe

pid	process
2188	ziuS8657.exe
4900	jr097743.exe
1448	ku974967.exe
1592	1.exe
4312	lr255233.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr097743.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exeziuS8657.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziuS8657.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 1448 WerFault.exe ku974967.exe

pid	pid_target	process	target process
1684	1448	WerFault.exe	ku974967.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1.exelr255233.exe61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exeziuS8657.exeku974967.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr255233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziuS8657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku974967.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr097743.exe

pid process

4900 jr097743.exe
4900 jr097743.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr097743.exeku974967.exe

description pid process

Token: SeDebugPrivilege 4900 jr097743.exe
Token: SeDebugPrivilege 1448 ku974967.exe

pid	process
4900	jr097743.exe
4900	jr097743.exe

description	pid	process
Token: SeDebugPrivilege	4900	jr097743.exe
Token: SeDebugPrivilege	1448	ku974967.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exeziuS8657.exeku974967.exe

description	pid	process	target process
PID 1300 wrote to memory of 2188	1300	61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe	ziuS8657.exe
PID 1300 wrote to memory of 2188	1300	61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe	ziuS8657.exe
PID 1300 wrote to memory of 2188	1300	61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe	ziuS8657.exe
PID 2188 wrote to memory of 4900	2188	ziuS8657.exe	jr097743.exe
PID 2188 wrote to memory of 4900	2188	ziuS8657.exe	jr097743.exe
PID 2188 wrote to memory of 1448	2188	ziuS8657.exe	ku974967.exe
PID 2188 wrote to memory of 1448	2188	ziuS8657.exe	ku974967.exe
PID 2188 wrote to memory of 1448	2188	ziuS8657.exe	ku974967.exe
PID 1448 wrote to memory of 1592	1448	ku974967.exe	1.exe
PID 1448 wrote to memory of 1592	1448	ku974967.exe	1.exe
PID 1448 wrote to memory of 1592	1448	ku974967.exe	1.exe
PID 1300 wrote to memory of 4312	1300	61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe	lr255233.exe
PID 1300 wrote to memory of 4312	1300	61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe	lr255233.exe
PID 1300 wrote to memory of 4312	1300	61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe	lr255233.exe

C:\Users\Admin\AppData\Local\Temp\61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe
"C:\Users\Admin\AppData\Local\Temp\61069fe14e8ad6aac455a6be2bbca1d9d26ab1c2581dbd1cf5af7af3718ce630.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuS8657.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuS8657.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr097743.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr097743.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku974967.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku974967.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1512
4⤵
- Program crash
PID:1684

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr255233.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr255233.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1448 -ip 1448
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr255233.exe

Filesize
169KB

MD5
57f137e131372a85bcbc694f06d8be60

SHA1
03540c4ed6bb4a6c95f1a2d434476fae88a34e81

SHA256
a6abd42048848cfc75005be5422c31744646b6d0705d90197a91db48114258c8

SHA512
4255747a57dc798899c11fb5f5fe22b6f8e4e368117b93874d072ab4751a312d86840749e676f28745a50016817a05220c0fa6a4c28b02808da8e84e1e8a43be

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuS8657.exe

Filesize
496KB

MD5
77d0a38c9aa51494fc00e65d1a324841

SHA1
2a0eddb53245138f7e415e281c474e662416d879

SHA256
fe6997d5e43ac9d5c67afab00c3ba33d1e51254bedfd24af77ef965b76f5517d

SHA512
5d09ee29d885481dd6f1a940948e86d301896cd1a1787a1a545ebbfb6fde3a35b77660fb93f33a6281e2f04cced6ea2e74d16822a57b4ed6850a856bfa409989

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr097743.exe

Filesize
12KB

MD5
457aa05ae710f23655707fa1ff19717d

SHA1
02811146d8a0affbd724f245709c2deef20eb83a

SHA256
b07497fbc7d49095c257e0d05ea39482d47a01d83360a751bd44bdcd226d1595

SHA512
3101ba53d91615e2807f7e50310eb4f3c4d0335b123fbe16c443e528902edfceb6e257684528812f307239b95d7eeed3992e23dd4fa5b0b5ed9a4e5cde59de53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku974967.exe

Filesize
414KB

MD5
a5595043ecec289c63a3b226903d8ea1

SHA1
bcc6544f8e4145ee4aabddd9e2d42a0ff1fa3c26

SHA256
31b3549696ca96dbc951dd7a47b5f72f261285dd06ab6e272df47af1a6a54b3a

SHA512
e906db2b4dee37c94c9cc0eccc9db2817fce58b61ac519cdbad735bdf42ee705d2455035226c4f4b8b180589edb4575a172b722b5580f3189c58636eb2f34ea6

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1448-50-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-86-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-24-0x0000000002710000-0x0000000002776000-memory.dmp

Filesize
408KB

Download
memory/1448-32-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-40-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-88-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-42-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-82-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-80-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-78-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-76-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-38-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-72-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-70-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-68-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-64-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-62-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-60-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-58-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-56-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-44-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-22-0x0000000002580000-0x00000000025E6000-memory.dmp

Filesize
408KB

Download
memory/1448-48-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-46-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-54-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-23-0x0000000004D10000-0x00000000052B4000-memory.dmp

Filesize
5.6MB

Download
memory/1448-74-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-36-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-34-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-30-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-28-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-84-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-66-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-52-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-26-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-25-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/1448-2105-0x0000000002790000-0x00000000027C2000-memory.dmp

Filesize
200KB

Download
memory/1592-2118-0x0000000000390000-0x00000000003C0000-memory.dmp

Filesize
192KB

Download
memory/1592-2119-0x00000000024E0000-0x00000000024E6000-memory.dmp

Filesize
24KB

Download
memory/1592-2120-0x00000000053E0000-0x00000000059F8000-memory.dmp

Filesize
6.1MB

Download
memory/1592-2121-0x0000000004ED0000-0x0000000004FDA000-memory.dmp

Filesize
1.0MB

Download
memory/1592-2122-0x0000000004C00000-0x0000000004C12000-memory.dmp

Filesize
72KB

Download
memory/1592-2123-0x0000000004C60000-0x0000000004C9C000-memory.dmp

Filesize
240KB

Download
memory/1592-2124-0x0000000004DC0000-0x0000000004E0C000-memory.dmp

Filesize
304KB

Download
memory/4312-2129-0x0000000000C50000-0x0000000000C7E000-memory.dmp

Filesize
184KB

Download
memory/4312-2130-0x0000000002EE0000-0x0000000002EE6000-memory.dmp

Filesize
24KB

Download
memory/4900-14-0x00007FF9A45E3000-0x00007FF9A45E5000-memory.dmp

Filesize
8KB

Download
memory/4900-15-0x0000000000370000-0x000000000037A000-memory.dmp

Filesize
40KB

Download
memory/4900-17-0x00007FF9A45E3000-0x00007FF9A45E5000-memory.dmp

Filesize
8KB

Download