healer | 360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe
Size

660KB
MD5

8aca52b8c31a6425fd5121ff0b6b7aba
SHA1

88206d07efa6ed45b5b87b015540cc4c90cc5ec6
SHA256

360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913
SHA512

83d48b021be12ee2ac0390db330b20217df45168b8d0520c25db6d49d1157d48f7154403eebd6ebce833feadb727decf972779c31edcf76f8c6fa1702e07ce90
SSDEEP

12288:2Mr2y906z8usXiUDzuy6urpX8/HPTech/qLYC/yqbUT8dUl8tIfZJ:8yRUyUmcMv40iyRe+ZJ

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b6a-12.dat	healer
behavioral1/memory/4868-15-0x0000000000B80000-0x0000000000B8A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr340854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr340854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr340854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr340854.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr340854.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr340854.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2280-2105-0x0000000002860000-0x0000000002892000-memory.dmp	family_redline
behavioral1/files/0x0002000000022dcd-2110.dat	family_redline
behavioral1/memory/3508-2118-0x0000000000260000-0x0000000000290000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b68-2127.dat	family_redline
behavioral1/memory/5160-2129-0x0000000000390000-0x00000000003BE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	ku537506.exe

Executes dropped EXE 5 IoCs

pid	Process
1332	ziBQ8771.exe
4868	jr340854.exe
2280	ku537506.exe
3508	1.exe
5160	lr913883.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr340854.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziBQ8771.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3416	2280	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziBQ8771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku537506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr913883.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	jr340854.exe
4868	jr340854.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	jr340854.exe
Token: SeDebugPrivilege	2280	ku537506.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1332	316	360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe	85
PID 316 wrote to memory of 1332	316	360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe	85
PID 316 wrote to memory of 1332	316	360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe	85
PID 1332 wrote to memory of 4868	1332	ziBQ8771.exe	86
PID 1332 wrote to memory of 4868	1332	ziBQ8771.exe	86
PID 1332 wrote to memory of 2280	1332	ziBQ8771.exe	89
PID 1332 wrote to memory of 2280	1332	ziBQ8771.exe	89
PID 1332 wrote to memory of 2280	1332	ziBQ8771.exe	89
PID 2280 wrote to memory of 3508	2280	ku537506.exe	90
PID 2280 wrote to memory of 3508	2280	ku537506.exe	90
PID 2280 wrote to memory of 3508	2280	ku537506.exe	90
PID 316 wrote to memory of 5160	316	360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe	94
PID 316 wrote to memory of 5160	316	360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe	94
PID 316 wrote to memory of 5160	316	360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe	94

C:\Users\Admin\AppData\Local\Temp\360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe
"C:\Users\Admin\AppData\Local\Temp\360e4b95377dd92921d6578a2f87dae98a3db8cadd36424296165bf347c9c913.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBQ8771.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBQ8771.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr340854.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr340854.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku537506.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku537506.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 996
      4⤵
      Program crash
      PID:3416
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr913883.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr913883.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2280 -ip 2280
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr913883.exe

Filesize
168KB

MD5
07929ec2a5a4538f60773e37be8a5423

SHA1
0dca9b7eff387006af7887a95fc067e1d20c46e5

SHA256
8ceeb15e611ef57dceb3db773ef96e2f65a5e10abbfc3a42f9c188b1fa113c73

SHA512
27dd9fb1739afff93c4346efd74aa4dbbcb572ca82ea5f2d2e4ec67f9ef3a419f25336431d6fc1254ed805ca2aae2a522266f62a766988774d16e818eead9edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBQ8771.exe

Filesize
507KB

MD5
903b8b235721cb461a81cdaade5fc7dc

SHA1
9a13b261f67a133f170e8652326c60982f82b248

SHA256
d5015afe53843d66d4809441227bf28c2abf5d95a469bf696e148ed77525fb69

SHA512
3f41b5c073dac13207abd1646c28eab1d0d17487dbf043cb6fea77f1ad326a7550dfabee764a310b56edfa188556d1eb9a2ddb2774f928bec0c89b4ec63426e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr340854.exe

Filesize
14KB

MD5
92abbd6830c34ce34de7478f839de25b

SHA1
87af0d6a3d2cc27a0507b23b87328033bcb7c49d

SHA256
6ed7c8201711575f8c3d800fbdf50397a3bf26f1e5f3d931aec5540b1548006c

SHA512
788730f20ccbf4cf46d7994834e2e40e2c12bbed14e1ebd7cee04b810af6100135612c645eeeba755ee86db472de20237fa2b2d6eac131c923df20304021c868

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku537506.exe

Filesize
426KB

MD5
107f033897cca1e4c803681aa440b6c2

SHA1
e17e5f373bc11fe74cb95ab9ea7d928039059b18

SHA256
0428b5a828c6ded054d4c1fb8ea8e2285ce416fedf57f1f7477dbfe9f095af93

SHA512
744ce00f289caa1765d5888b6c9d52d4e93168b5d4a8c9e490cb588719ab4c622db017d8ac43741ab8c0259d782156467753865380920851376d07e2ef39f31b

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2280-50-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-84-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-24-0x0000000005390000-0x00000000053F6000-memory.dmp

Filesize
408KB

Download
memory/2280-42-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-88-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-86-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-38-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-82-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-80-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-78-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-76-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-36-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-72-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-70-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-66-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-64-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-62-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-60-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-58-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-56-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-40-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-22-0x00000000027B0000-0x0000000002816000-memory.dmp

Filesize
408KB

Download
memory/2280-48-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-44-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-54-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-23-0x0000000004DE0000-0x0000000005384000-memory.dmp

Filesize
5.6MB

Download
memory/2280-74-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-34-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-32-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-30-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-28-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-68-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-26-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-52-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-46-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-25-0x0000000005390000-0x00000000053EF000-memory.dmp

Filesize
380KB

Download
memory/2280-2105-0x0000000002860000-0x0000000002892000-memory.dmp

Filesize
200KB

Download
memory/3508-2118-0x0000000000260000-0x0000000000290000-memory.dmp

Filesize
192KB

Download
memory/3508-2119-0x0000000002400000-0x0000000002406000-memory.dmp

Filesize
24KB

Download
memory/3508-2120-0x00000000051B0000-0x00000000057C8000-memory.dmp

Filesize
6.1MB

Download
memory/3508-2121-0x0000000004CA0000-0x0000000004DAA000-memory.dmp

Filesize
1.0MB

Download
memory/3508-2122-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3508-2123-0x0000000004C30000-0x0000000004C6C000-memory.dmp

Filesize
240KB

Download
memory/3508-2124-0x0000000004DB0000-0x0000000004DFC000-memory.dmp

Filesize
304KB

Download
memory/4868-14-0x00007FFDF0FD3000-0x00007FFDF0FD5000-memory.dmp

Filesize
8KB

Download
memory/4868-15-0x0000000000B80000-0x0000000000B8A000-memory.dmp

Filesize
40KB

Download
memory/4868-16-0x00007FFDF0FD3000-0x00007FFDF0FD5000-memory.dmp

Filesize
8KB

Download
memory/5160-2129-0x0000000000390000-0x00000000003BE000-memory.dmp

Filesize
184KB

Download
memory/5160-2130-0x0000000002560000-0x0000000002566000-memory.dmp

Filesize
24KB

Download