healer | 232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe
Size

650KB
MD5

99dc0502edfc0277d8b7112ee5643977
SHA1

85b4c71c2c87c8a30db2357fb31ab7e5dba96d51
SHA256

232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b
SHA512

640858076e0198d9619054e1413867c6dcf225d1d0a6f3d5a5f940b40b619770d411374a27f7e6e2ec9f26c812197ff11f63137fa456ff1c3191494f92cbe546
SSDEEP

12288:ZMrry90Kv4xTARM5Xu96Kibz9p3UUEOLiYuLTopX:2yVgW25Xu96Kibxp3Ur2uLTO

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr866111.exe	healer
behavioral1/memory/380-15-0x00000000003B0000-0x00000000003BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr866111.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr866111.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr866111.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr866111.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr866111.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr866111.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr866111.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3244-2105-0x00000000053F0000-0x0000000005422000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/4168-2118-0x00000000006B0000-0x00000000006E0000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr375194.exe	family_redline
behavioral1/memory/4600-2129-0x00000000000E0000-0x000000000010E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku911889.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	ku911889.exe

Executes dropped EXE 5 IoCs

Processes:

ziFk3731.exejr866111.exeku911889.exe1.exelr375194.exe

pid process

972 ziFk3731.exe
380 jr866111.exe
3244 ku911889.exe
4168 1.exe
4600 lr375194.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr866111.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr866111.exe

pid	process
972	ziFk3731.exe
380	jr866111.exe
3244	ku911889.exe
4168	1.exe
4600	lr375194.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr866111.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exeziFk3731.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziFk3731.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3376 3244 WerFault.exe ku911889.exe

pid	pid_target	process	target process
3376	3244	WerFault.exe	ku911889.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1.exelr375194.exe232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exeziFk3731.exeku911889.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr375194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziFk3731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku911889.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr866111.exe

pid process

380 jr866111.exe
380 jr866111.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr866111.exeku911889.exe

description pid process

Token: SeDebugPrivilege 380 jr866111.exe
Token: SeDebugPrivilege 3244 ku911889.exe

pid	process
380	jr866111.exe
380	jr866111.exe

description	pid	process
Token: SeDebugPrivilege	380	jr866111.exe
Token: SeDebugPrivilege	3244	ku911889.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exeziFk3731.exeku911889.exe

description	pid	process	target process
PID 3552 wrote to memory of 972	3552	232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe	ziFk3731.exe
PID 3552 wrote to memory of 972	3552	232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe	ziFk3731.exe
PID 3552 wrote to memory of 972	3552	232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe	ziFk3731.exe
PID 972 wrote to memory of 380	972	ziFk3731.exe	jr866111.exe
PID 972 wrote to memory of 380	972	ziFk3731.exe	jr866111.exe
PID 972 wrote to memory of 3244	972	ziFk3731.exe	ku911889.exe
PID 972 wrote to memory of 3244	972	ziFk3731.exe	ku911889.exe
PID 972 wrote to memory of 3244	972	ziFk3731.exe	ku911889.exe
PID 3244 wrote to memory of 4168	3244	ku911889.exe	1.exe
PID 3244 wrote to memory of 4168	3244	ku911889.exe	1.exe
PID 3244 wrote to memory of 4168	3244	ku911889.exe	1.exe
PID 3552 wrote to memory of 4600	3552	232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe	lr375194.exe
PID 3552 wrote to memory of 4600	3552	232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe	lr375194.exe
PID 3552 wrote to memory of 4600	3552	232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe	lr375194.exe

C:\Users\Admin\AppData\Local\Temp\232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe
"C:\Users\Admin\AppData\Local\Temp\232d7c43240d2475a4aae3db6bfcd8288d2e53bff32d2ecc04fbd73e428f0b9b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFk3731.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFk3731.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr866111.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr866111.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku911889.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku911889.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 1384
4⤵
- Program crash
PID:3376

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr375194.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr375194.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3244 -ip 3244
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr375194.exe

Filesize
168KB

MD5
035d34178afb9a82d910850a4493bbe8

SHA1
c62dbf65101d4a661f136f098f3affa7a0969064

SHA256
0395e78efa7123bf328cc2029206f242989a32379fb967412445674c7f5fba13

SHA512
9f0bb03745a701814edb42214be17340872d16e6a164f57d323f9bd06e7ad74abd1b5860a2272be558fe58f9860667567bd8ee17a16a475e9418aa1587956343

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFk3731.exe

Filesize
496KB

MD5
19b9ac0ea243f12993d4ecd61d09ecb3

SHA1
8a7d682050d780ae00b56009799c26b5fd802880

SHA256
350861e327027feaf6881f2b7edee584a0083fa593a53308722f25c89317bd6e

SHA512
b407f006dcf2d651a7095d928e21840869d445fcd380b311f938c748ce4aaeddcb1eb061516c9adf0e03c61bdc9155f94b2ebff2d6e02feb2583b1431ee2326e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr866111.exe

Filesize
11KB

MD5
5fc4fc05095c829c6ac00471b69a4b49

SHA1
4b5967181705a0471cce61e682733b18235dea2e

SHA256
3652b350e48cd2fd115e69232a9a8e7f1ad52475e4179d31f851a899eb46c1ae

SHA512
f5ab09eb9bb95ec96f6b2d88cbfc52259f6db3bd879ba53a454d222430288b7f0ee48a6f3711acb8ed88514c386e82ffcd9ccfe46f1d15c0d793dfbaba82c2b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku911889.exe

Filesize
414KB

MD5
c634668f5e5988ac579d67ee649b994a

SHA1
d3ec1d310570b508a741d540ee6d820938b53b87

SHA256
1644fb878bf032453cba782bf6c1473bb8bf5ed264fef9a19ec2cb6fab1769aa

SHA512
bec99f0d74b1add5295f558f98de5d58b939e4b676a56dec58a842099d16647f595ba57120c03c8ad72095e97fdfb17665d4cfed251d052a3f845204706715a3

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/380-14-0x00007FFBABA53000-0x00007FFBABA55000-memory.dmp

Filesize
8KB

Download
memory/380-15-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/380-16-0x00007FFBABA53000-0x00007FFBABA55000-memory.dmp

Filesize
8KB

Download
memory/3244-22-0x0000000002570000-0x00000000025D6000-memory.dmp

Filesize
408KB

Download
memory/3244-23-0x0000000004C50000-0x00000000051F4000-memory.dmp

Filesize
5.6MB

Download
memory/3244-24-0x0000000005200000-0x0000000005266000-memory.dmp

Filesize
408KB

Download
memory/3244-42-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-44-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-88-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-86-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-84-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-82-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-80-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-78-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-76-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-72-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-70-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-68-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-66-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-64-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-62-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-60-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-56-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-54-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-52-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-50-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-48-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-46-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-40-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-38-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-36-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-34-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-32-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-30-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-28-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-74-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-58-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-26-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-25-0x0000000005200000-0x000000000525F000-memory.dmp

Filesize
380KB

Download
memory/3244-2105-0x00000000053F0000-0x0000000005422000-memory.dmp

Filesize
200KB

Download
memory/4168-2118-0x00000000006B0000-0x00000000006E0000-memory.dmp

Filesize
192KB

Download
memory/4168-2119-0x0000000002800000-0x0000000002806000-memory.dmp

Filesize
24KB

Download
memory/4168-2120-0x0000000005650000-0x0000000005C68000-memory.dmp

Filesize
6.1MB

Download
memory/4168-2121-0x0000000005140000-0x000000000524A000-memory.dmp

Filesize
1.0MB

Download
memory/4168-2122-0x0000000005030000-0x0000000005042000-memory.dmp

Filesize
72KB

Download
memory/4168-2123-0x0000000005050000-0x000000000508C000-memory.dmp

Filesize
240KB

Download
memory/4168-2124-0x00000000050D0000-0x000000000511C000-memory.dmp

Filesize
304KB

Download
memory/4600-2129-0x00000000000E0000-0x000000000010E000-memory.dmp

Filesize
184KB

Download
memory/4600-2130-0x0000000002360000-0x0000000002366000-memory.dmp

Filesize
24KB

Download