healer | 2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe
Size

660KB
MD5

ff750522881f79cb415ccf42413c04ae
SHA1

872257f402ff8605a409f4b5d481938f7f0d50f8
SHA256

2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e
SHA512

41052bd58c95d30d7dba45147855a3c2f27206a3e4eec5ac64962706e37e867c60b85982203c23c4a2dc72fbe3b63db0d07f212ccfebcc9c25ed8dd10c69ab07
SSDEEP

12288:GMrqy90GdOrLg1r+PkJvDqZ92ZlEDikKhEGYFT8L6SPPQN2CVi:IypdcLg1r+2EkvcGRDPxKi

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b9a-12.dat	healer
behavioral1/memory/2792-15-0x0000000000390000-0x000000000039A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr080899.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr080899.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr080899.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr080899.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr080899.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr080899.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/4148-2104-0x0000000005550000-0x0000000005582000-memory.dmp	family_redline
behavioral1/files/0x0009000000023ae6-2109.dat	family_redline
behavioral1/memory/5984-2116-0x0000000000180000-0x00000000001B0000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b98-2126.dat	family_redline
behavioral1/memory/1004-2128-0x00000000002C0000-0x00000000002EE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	ku189335.exe

Executes dropped EXE 5 IoCs

pid	Process
1780	ziyy7301.exe
2792	jr080899.exe
4148	ku189335.exe
5984	1.exe
1004	lr614779.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr080899.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziyy7301.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6100	4148	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku189335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr614779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziyy7301.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	jr080899.exe
2792	jr080899.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	jr080899.exe
Token: SeDebugPrivilege	4148	ku189335.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1780	4916	2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe	83
PID 4916 wrote to memory of 1780	4916	2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe	83
PID 4916 wrote to memory of 1780	4916	2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe	83
PID 1780 wrote to memory of 2792	1780	ziyy7301.exe	84
PID 1780 wrote to memory of 2792	1780	ziyy7301.exe	84
PID 1780 wrote to memory of 4148	1780	ziyy7301.exe	93
PID 1780 wrote to memory of 4148	1780	ziyy7301.exe	93
PID 1780 wrote to memory of 4148	1780	ziyy7301.exe	93
PID 4148 wrote to memory of 5984	4148	ku189335.exe	94
PID 4148 wrote to memory of 5984	4148	ku189335.exe	94
PID 4148 wrote to memory of 5984	4148	ku189335.exe	94
PID 4916 wrote to memory of 1004	4916	2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe	98
PID 4916 wrote to memory of 1004	4916	2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe	98
PID 4916 wrote to memory of 1004	4916	2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe	98

C:\Users\Admin\AppData\Local\Temp\2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe
"C:\Users\Admin\AppData\Local\Temp\2a524e9167f29ed2a7973568c68c0a6e8ae43eb8b5de9c6128291adbb7a9963e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyy7301.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyy7301.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr080899.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr080899.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku189335.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku189335.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5984
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 1376
      4⤵
      Program crash
      PID:6100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr614779.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr614779.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4148 -ip 4148
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr614779.exe

Filesize
169KB

MD5
280231cf4d0cd1686e6fed92299d8160

SHA1
581dbd4fc62e682267048bbf9467f6571140703e

SHA256
b18a74d3b9c0ee533082f3aa665b418e7855f7fe37f725297c600031105ecb41

SHA512
e16aecce09b322d9a9a64173d3aac525547cd4e733559ac45f849102aaf304f237c9d64ead98250f4c368374a981da5415c6bb7c31442f13dcc68f38de18aecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziyy7301.exe

Filesize
507KB

MD5
30e8b6a74044f1013a398bd795c4986b

SHA1
29a50cddfd285029bd9cee6cb02c4a255af12c10

SHA256
eb34b4e842e548f62b20fb73b6dc9dd5eded2131c2c012f602403da3aae8dfe5

SHA512
940e36a927adc33464d237b1afb59f7bae6c147c4ac00fbd54db5335daf5d514edf8f8b74224926aeab3e4b858ccbb44155edd4eaaf11b1932f65fc619ed0d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr080899.exe

Filesize
15KB

MD5
8f5ef06d72d9cb9f4d3d053169f13ac6

SHA1
b85ab9b94e072b3ece17f6a85cffff691fe9edf1

SHA256
ebfac8cccaefd6c02ed2a16aa3e00f3c2282a103f7146fa243059d10f251df09

SHA512
2a22bf7ba357710184432f429cd429d7253a4cf0137555b1742df29ba48dedaa9794493ae6ddedee06508bcace1eedbb3793579baabbc2ad356376380ab14812

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku189335.exe

Filesize
426KB

MD5
b70f686e0673559cc73e5b227891a590

SHA1
7e64dd1a20a67751e329a3ec84d11d4f8ce7cebd

SHA256
08b45cdf8f39b5604929b654dc27d5b1edd545cb5e9c29c9ba0b8bda4c1801e1

SHA512
2dd5c976442308ad369529a6daf3c71c2725e47feef3bded0fcffb03cf7dfbc648273685e45e97adc83b61e1e252c8873a425aba005b1a687cf1c31896d21331

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1004-2128-0x00000000002C0000-0x00000000002EE000-memory.dmp

Filesize
184KB

Download
memory/1004-2129-0x0000000004BE0000-0x0000000004BE6000-memory.dmp

Filesize
24KB

Download
memory/2792-14-0x00007FFEE80C3000-0x00007FFEE80C5000-memory.dmp

Filesize
8KB

Download
memory/2792-15-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download
memory/4148-61-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-53-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-23-0x0000000005380000-0x00000000053E6000-memory.dmp

Filesize
408KB

Download
memory/4148-29-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-41-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-87-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-85-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-83-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-81-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-79-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-77-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-75-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-73-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-69-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-67-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-65-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-63-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-21-0x0000000002700000-0x0000000002766000-memory.dmp

Filesize
408KB

Download
memory/4148-59-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-57-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-55-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-22-0x0000000004DD0000-0x0000000005374000-memory.dmp

Filesize
5.6MB

Download
memory/4148-51-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-49-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-45-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-43-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-39-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-37-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-35-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-33-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-31-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-27-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-71-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-47-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-25-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-24-0x0000000005380000-0x00000000053DF000-memory.dmp

Filesize
380KB

Download
memory/4148-2104-0x0000000005550000-0x0000000005582000-memory.dmp

Filesize
200KB

Download
memory/5984-2116-0x0000000000180000-0x00000000001B0000-memory.dmp

Filesize
192KB

Download
memory/5984-2118-0x0000000006DF0000-0x0000000006DF6000-memory.dmp

Filesize
24KB

Download
memory/5984-2119-0x0000000005090000-0x00000000056A8000-memory.dmp

Filesize
6.1MB

Download
memory/5984-2120-0x0000000004BC0000-0x0000000004CCA000-memory.dmp

Filesize
1.0MB

Download
memory/5984-2121-0x0000000004AF0000-0x0000000004B02000-memory.dmp

Filesize
72KB

Download
memory/5984-2122-0x0000000004B50000-0x0000000004B8C000-memory.dmp

Filesize
240KB

Download
memory/5984-2123-0x0000000004CD0000-0x0000000004D1C000-memory.dmp

Filesize
304KB

Download