healer | 671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe
Size

652KB
MD5

55a82aba874170238ca6e23627fe63c7
SHA1

5a6f13fb2a236e85ec8b4d5d14e25e021801e05f
SHA256

671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0
SHA512

ecd38ef23ecc1422f334d234fd64901c015715c39aa1bbe3f8c2863ba378779cebbb8e2970acd8e9163f352ac204e7da756e523c212723595d9ca033b07c5ab8
SSDEEP

12288:FMr8y90q5uTf1Q2fNfeOnJr4Q3aFprNsAKRn8ooyTsSdyiorUOPselVYyI+WOapg:5yqTfDfA8JcxB0LiPFNI/OKel

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr400704.exe	healer
behavioral1/memory/1596-15-0x0000000000A40000-0x0000000000A4A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

jr400704.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr400704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr400704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr400704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr400704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr400704.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr400704.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4012-2105-0x0000000005540000-0x0000000005572000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/3912-2118-0x0000000000BA0000-0x0000000000BD0000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr365144.exe	family_redline
behavioral1/memory/2004-2129-0x0000000000A80000-0x0000000000AAE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ku826395.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	ku826395.exe

Executes dropped EXE 5 IoCs

Processes:

ziUd8729.exejr400704.exeku826395.exe1.exelr365144.exe

pid process

2144 ziUd8729.exe
1596 jr400704.exe
4012 ku826395.exe
3912 1.exe
2004 lr365144.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

jr400704.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr400704.exe

pid	process
2144	ziUd8729.exe
1596	jr400704.exe
4012	ku826395.exe
3912	1.exe
2004	lr365144.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr400704.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exeziUd8729.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziUd8729.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1092 4012 WerFault.exe ku826395.exe

pid	pid_target	process	target process
1092	4012	WerFault.exe	ku826395.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

lr365144.exe671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exeziUd8729.exeku826395.exe1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr365144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziUd8729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku826395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jr400704.exe

pid process

1596 jr400704.exe
1596 jr400704.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

jr400704.exeku826395.exe

description pid process

Token: SeDebugPrivilege 1596 jr400704.exe
Token: SeDebugPrivilege 4012 ku826395.exe

pid	process
1596	jr400704.exe
1596	jr400704.exe

description	pid	process
Token: SeDebugPrivilege	1596	jr400704.exe
Token: SeDebugPrivilege	4012	ku826395.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exeziUd8729.exeku826395.exe

description	pid	process	target process
PID 464 wrote to memory of 2144	464	671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe	ziUd8729.exe
PID 464 wrote to memory of 2144	464	671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe	ziUd8729.exe
PID 464 wrote to memory of 2144	464	671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe	ziUd8729.exe
PID 2144 wrote to memory of 1596	2144	ziUd8729.exe	jr400704.exe
PID 2144 wrote to memory of 1596	2144	ziUd8729.exe	jr400704.exe
PID 2144 wrote to memory of 4012	2144	ziUd8729.exe	ku826395.exe
PID 2144 wrote to memory of 4012	2144	ziUd8729.exe	ku826395.exe
PID 2144 wrote to memory of 4012	2144	ziUd8729.exe	ku826395.exe
PID 4012 wrote to memory of 3912	4012	ku826395.exe	1.exe
PID 4012 wrote to memory of 3912	4012	ku826395.exe	1.exe
PID 4012 wrote to memory of 3912	4012	ku826395.exe	1.exe
PID 464 wrote to memory of 2004	464	671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe	lr365144.exe
PID 464 wrote to memory of 2004	464	671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe	lr365144.exe
PID 464 wrote to memory of 2004	464	671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe	lr365144.exe

C:\Users\Admin\AppData\Local\Temp\671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe
"C:\Users\Admin\AppData\Local\Temp\671b387a844f235a275724cbbc4b1c5dabdc449c239a137e84d1d08d9e9087b0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUd8729.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUd8729.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr400704.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr400704.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku826395.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku826395.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 1380
4⤵
- Program crash
PID:1092

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr365144.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr365144.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4012 -ip 4012
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr365144.exe

Filesize
169KB

MD5
5e002bee7256b3daab0e8f61b19f7216

SHA1
ef3a0004161aab90d9d86bb32cbc40d5f6a8fc9e

SHA256
2ee0a77e9d10c5eb0f06630dea6b3cdc0214a450c48e31fc7c680aeb576be20e

SHA512
24c065589ca36f94723d998fa94a0571f52bd2a0519cc970926d6ed7213a7d9108ac70ef8624127da2ce109ed6c6388fdfbbe8aa633bff0dfe433ae2dd87af83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziUd8729.exe

Filesize
498KB

MD5
278ceb69cc33377cd95eacb8f1b29600

SHA1
ba7f625ecbc70a0d55c89ca133a37de50c546e06

SHA256
11723c2478344644988b84cbd554a5d2d602d9aaf52873a2f96b2f6d143b2b81

SHA512
c435960a36dd9c575f6684b19e1885547c6b8f29a5af27f16fe388e4d04838084008f5174d9c3c3810fade8f047e06c233bd3e34765dfae3847106d8b6527cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr400704.exe

Filesize
12KB

MD5
946715281c55da8bae779e575fa7f34f

SHA1
9c477461107ffa8ee62c01ad417940f09e177999

SHA256
0c9eac02a51d41d0fe1c608c78a7d0dfa2c86afa1e145eb3066eee1b26910099

SHA512
164cc0755923abfc1e3450ece2508de8fb2bdacc311fb207846fc62d89759904de1c185f49d200953a8b427b5302f22bda829956e98afb86bc025a8d772b4d1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku826395.exe

Filesize
417KB

MD5
588fa09ef33bf1a7d8bf57ffb20dc746

SHA1
dcf37399e6409f494ff6f2193db72375f8debfe3

SHA256
074cf633678ed57fc0b17b801add15bf83229462191171ba2910778608e5b455

SHA512
5b1326431b38d0b59a6b20cc7fde84542ab26f3377e47618110402929a03d794223980c401e4906e336cc098e10fe89e728f775f945704eed84d6d393ba607e8

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1596-14-0x00007FFCD5013000-0x00007FFCD5015000-memory.dmp

Filesize
8KB

Download
memory/1596-16-0x00007FFCD5013000-0x00007FFCD5015000-memory.dmp

Filesize
8KB

Download
memory/1596-15-0x0000000000A40000-0x0000000000A4A000-memory.dmp

Filesize
40KB

Download
memory/2004-2130-0x0000000002E40000-0x0000000002E46000-memory.dmp

Filesize
24KB

Download
memory/2004-2129-0x0000000000A80000-0x0000000000AAE000-memory.dmp

Filesize
184KB

Download
memory/3912-2118-0x0000000000BA0000-0x0000000000BD0000-memory.dmp

Filesize
192KB

Download
memory/3912-2119-0x0000000002D50000-0x0000000002D56000-memory.dmp

Filesize
24KB

Download
memory/3912-2120-0x0000000005B90000-0x00000000061A8000-memory.dmp

Filesize
6.1MB

Download
memory/3912-2124-0x00000000055F0000-0x000000000563C000-memory.dmp

Filesize
304KB

Download
memory/3912-2123-0x00000000055B0000-0x00000000055EC000-memory.dmp

Filesize
240KB

Download
memory/3912-2122-0x0000000005410000-0x0000000005422000-memory.dmp

Filesize
72KB

Download
memory/3912-2121-0x0000000005680000-0x000000000578A000-memory.dmp

Filesize
1.0MB

Download
memory/4012-66-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-42-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-82-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-80-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-78-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-76-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-74-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-70-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-68-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-88-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-64-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-62-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-60-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-54-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-52-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-50-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-48-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-46-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-44-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-84-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-38-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-36-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-34-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-32-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-30-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-29-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-56-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-25-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-26-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-40-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-24-0x0000000005350000-0x00000000053B6000-memory.dmp

Filesize
408KB

Download
memory/4012-23-0x0000000004DA0000-0x0000000005344000-memory.dmp

Filesize
5.6MB

Download
memory/4012-22-0x0000000004BE0000-0x0000000004C46000-memory.dmp

Filesize
408KB

Download
memory/4012-86-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-72-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-58-0x0000000005350000-0x00000000053AF000-memory.dmp

Filesize
380KB

Download
memory/4012-2105-0x0000000005540000-0x0000000005572000-memory.dmp

Filesize
200KB

Download