healer | 437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe
Size

652KB
MD5

4a989fa705deb9ef3da191075817b446
SHA1

f5e20651c79024abe28e501c437b031367db101e
SHA256

437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5
SHA512

5189b8212b71a172a08dc3b49686e96545a2b5fac7012579445e87d86ea34fc36a1aeb9b274146b76aa61b384c53e62a7d4c2bcc2f5ca80f514e2e06046ddd76
SSDEEP

12288:NMrRy90bCJYW+ICCqKbLNXs5oITsDA/inrDxPxitVQzDK3RIRppoz:ky9NzqALup4P0IDK36Rppoz

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr856276.exe	healer
behavioral1/memory/1936-15-0x0000000000910000-0x000000000091A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr856276.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr856276.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr856276.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr856276.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr856276.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr856276.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr856276.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4696-2105-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/5532-2118-0x0000000000BF0000-0x0000000000C20000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr244960.exe	family_redline
behavioral1/memory/6028-2129-0x0000000000380000-0x00000000003AE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku374099.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	ku374099.exe

Executes dropped EXE 5 IoCs

Processes:

zitI1540.exejr856276.exeku374099.exe1.exelr244960.exe

pid process

2748 zitI1540.exe
1936 jr856276.exe
4696 ku374099.exe
5532 1.exe
6028 lr244960.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr856276.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr856276.exe

pid	process
2748	zitI1540.exe
1936	jr856276.exe
4696	ku374099.exe
5532	1.exe
6028	lr244960.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr856276.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

zitI1540.exe437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zitI1540.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5128 4696 WerFault.exe ku374099.exe

pid	pid_target	process	target process
5128	4696	WerFault.exe	ku374099.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

lr244960.exe437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exezitI1540.exeku374099.exe1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr244960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zitI1540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku374099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr856276.exe

pid process

1936 jr856276.exe
1936 jr856276.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr856276.exeku374099.exe

description pid process

Token: SeDebugPrivilege 1936 jr856276.exe
Token: SeDebugPrivilege 4696 ku374099.exe

pid	process
1936	jr856276.exe
1936	jr856276.exe

description	pid	process
Token: SeDebugPrivilege	1936	jr856276.exe
Token: SeDebugPrivilege	4696	ku374099.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exezitI1540.exeku374099.exe

description	pid	process	target process
PID 552 wrote to memory of 2748	552	437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe	zitI1540.exe
PID 552 wrote to memory of 2748	552	437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe	zitI1540.exe
PID 552 wrote to memory of 2748	552	437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe	zitI1540.exe
PID 2748 wrote to memory of 1936	2748	zitI1540.exe	jr856276.exe
PID 2748 wrote to memory of 1936	2748	zitI1540.exe	jr856276.exe
PID 2748 wrote to memory of 4696	2748	zitI1540.exe	ku374099.exe
PID 2748 wrote to memory of 4696	2748	zitI1540.exe	ku374099.exe
PID 2748 wrote to memory of 4696	2748	zitI1540.exe	ku374099.exe
PID 4696 wrote to memory of 5532	4696	ku374099.exe	1.exe
PID 4696 wrote to memory of 5532	4696	ku374099.exe	1.exe
PID 4696 wrote to memory of 5532	4696	ku374099.exe	1.exe
PID 552 wrote to memory of 6028	552	437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe	lr244960.exe
PID 552 wrote to memory of 6028	552	437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe	lr244960.exe
PID 552 wrote to memory of 6028	552	437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe	lr244960.exe

C:\Users\Admin\AppData\Local\Temp\437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe
"C:\Users\Admin\AppData\Local\Temp\437e3b6d6efa061ad5105321b8410a6f7a3dbf5ecdffe0e621b4ddba5b2cfea5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitI1540.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitI1540.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr856276.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr856276.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku374099.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku374099.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1188
4⤵
- Program crash
PID:5128

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr244960.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr244960.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4696 -ip 4696
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr244960.exe

Filesize
169KB

MD5
31f70adbdffde72cd3ce94f3048f81d7

SHA1
7dddc3e4451de653a49416689b9ff7a7620cc253

SHA256
a89de009f4d1a6c456ed9b7d1e4950fccea04f6ec59773add42895622ee2c7d1

SHA512
07611206e7730919c8c28fdd0130d01b2cfe01e66fd1f4d58900928c401d4848b91f767ba746a52f6e7631a12d2fa69845757b68aab11c4d8b38002cb7426427

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitI1540.exe

Filesize
498KB

MD5
d0dba9366670fea5b56f8dc07ad97ecd

SHA1
3a6152d3d9012028036e8e53af9a2ff45fa644c8

SHA256
8920c8a43e8908fb3c0d64dfb88a46f0f246087e6b5b3ed067013a1af7f24ccf

SHA512
9498529a63fb3ee9b007e9e88656af0ce37c65c9f0e864483ee873a1f4157b61eeadba8512e05c934212d7009358f52f94e1083ca5b49d561071756414d4d8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr856276.exe

Filesize
12KB

MD5
40b97bea8ea482efe7dcac99ff346975

SHA1
edc0d003964280d9c4d474c83c431b2de02ac484

SHA256
5972944f9520140b581f507781d18c4748db6a3ead7358e1983979a485cd10cf

SHA512
d5bd8f8f05872b7045493276bb4833c332b244a46aeb96209b68bff389aba699be83961a9cb854fb329754d6b462e40cf62a268c763db0bce05c724989e534e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku374099.exe

Filesize
417KB

MD5
8b8d8f5883e7ff86a31b334ea6df1266

SHA1
7f29e17aa685b6ab5bc823befc5f280faed9a870

SHA256
2fe172c2e151e9c5576b05fe835d092c55cf3947d31c44387effea3e69d76e9a

SHA512
3ce57ddddf0147f54883e57a9c1df5142c84479c70463ae456d19e0a9c4bd18329969929bbadb2968fc9f6a6b001a2e3b4de1e1b48bdbf0510c31dde1d88819d

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1936-14-0x00007FFF2FFB3000-0x00007FFF2FFB5000-memory.dmp

Filesize
8KB

Download
memory/1936-15-0x0000000000910000-0x000000000091A000-memory.dmp

Filesize
40KB

Download
memory/1936-16-0x00007FFF2FFB3000-0x00007FFF2FFB5000-memory.dmp

Filesize
8KB

Download
memory/4696-22-0x0000000002570000-0x00000000025D6000-memory.dmp

Filesize
408KB

Download
memory/4696-23-0x0000000004C50000-0x00000000051F4000-memory.dmp

Filesize
5.6MB

Download
memory/4696-24-0x0000000005200000-0x0000000005266000-memory.dmp

Filesize
408KB

Download
memory/4696-26-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-34-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-88-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-86-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-84-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-82-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-80-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-78-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-74-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-72-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-68-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-67-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-64-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-62-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-60-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-58-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-56-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-54-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-52-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-50-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-48-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-46-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-42-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-40-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-38-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-36-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-32-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-30-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-28-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-76-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-70-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-44-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-25-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/4696-2105-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/5532-2118-0x0000000000BF0000-0x0000000000C20000-memory.dmp

Filesize
192KB

Download
memory/5532-2119-0x0000000002CA0000-0x0000000002CA6000-memory.dmp

Filesize
24KB

Download
memory/5532-2120-0x0000000005BC0000-0x00000000061D8000-memory.dmp

Filesize
6.1MB

Download
memory/5532-2121-0x00000000056B0000-0x00000000057BA000-memory.dmp

Filesize
1.0MB

Download
memory/5532-2122-0x0000000005560000-0x0000000005572000-memory.dmp

Filesize
72KB

Download
memory/5532-2123-0x00000000055E0000-0x000000000561C000-memory.dmp

Filesize
240KB

Download
memory/5532-2124-0x0000000005620000-0x000000000566C000-memory.dmp

Filesize
304KB

Download
memory/6028-2129-0x0000000000380000-0x00000000003AE000-memory.dmp

Filesize
184KB

Download
memory/6028-2130-0x00000000024F0000-0x00000000024F6000-memory.dmp

Filesize
24KB

Download