healer | 134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe
Size

661KB
MD5

ef5ed4e43f8040fe4c663359f7e036e7
SHA1

a0beb3cb164c00b07d58b1b3fc91ddcd13a0d9b5
SHA256

134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503
SHA512

0cb2489e01c2711adb289a67a32ad82493916d519c0a32dab06cd23f06587dd9fb55db85fc7405742c4580f0685277d17031a5e5947028deae2f05548539c4c9
SSDEEP

12288:PMrWy90fgG94j1jEnsJMt2AW9Oqed84QuaoJObcl6xozrqe9ob02YdSD:lyXG94jNEqxU3SsObclItgdU

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c8f-12.dat	healer
behavioral1/memory/2876-15-0x0000000000390000-0x000000000039A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr221242.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr221242.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr221242.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr221242.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr221242.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr221242.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/4244-2104-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
behavioral1/files/0x000d000000023b3f-2109.dat	family_redline
behavioral1/memory/4536-2117-0x00000000003F0000-0x0000000000420000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c8c-2126.dat	family_redline
behavioral1/memory/2924-2128-0x0000000000AE0000-0x0000000000B0E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	ku175441.exe

Executes dropped EXE 5 IoCs

pid	Process
1736	ziex0784.exe
2876	jr221242.exe
4244	ku175441.exe
4536	1.exe
2924	lr673841.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr221242.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziex0784.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5564	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	4244	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziex0784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku175441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr673841.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	jr221242.exe
2876	jr221242.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	jr221242.exe
Token: SeDebugPrivilege	4244	ku175441.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1736	1852	134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe	83
PID 1852 wrote to memory of 1736	1852	134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe	83
PID 1852 wrote to memory of 1736	1852	134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe	83
PID 1736 wrote to memory of 2876	1736	ziex0784.exe	84
PID 1736 wrote to memory of 2876	1736	ziex0784.exe	84
PID 1736 wrote to memory of 4244	1736	ziex0784.exe	95
PID 1736 wrote to memory of 4244	1736	ziex0784.exe	95
PID 1736 wrote to memory of 4244	1736	ziex0784.exe	95
PID 4244 wrote to memory of 4536	4244	ku175441.exe	96
PID 4244 wrote to memory of 4536	4244	ku175441.exe	96
PID 4244 wrote to memory of 4536	4244	ku175441.exe	96
PID 1852 wrote to memory of 2924	1852	134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe	101
PID 1852 wrote to memory of 2924	1852	134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe	101
PID 1852 wrote to memory of 2924	1852	134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe	101

C:\Users\Admin\AppData\Local\Temp\134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe
"C:\Users\Admin\AppData\Local\Temp\134b183550875799bba88055f4f30bbfa366bfb39f0835c2460afd2fba6e7503.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziex0784.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziex0784.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr221242.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr221242.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku175441.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku175441.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1376
      4⤵
      Program crash
      PID:1600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr673841.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr673841.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4244 -ip 4244
1⤵
PID:1188

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:5564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr673841.exe

Filesize
168KB

MD5
2499998de373457c46bcf42b01f29693

SHA1
7d7aae0951e01d0a90eddc1154901f9f560f7c8a

SHA256
4a8c7591450fcbdeb8e7a8193acc63ae76bba167fcfd385ee1f72012763e92fc

SHA512
d29301607222f3b5325e5dd898f7d6554315b6a7512f565191f5d8e601678a129f60e4fadad4462a1cfb23221982f5459ff068d96a7b7fea150af20e52b5e13f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziex0784.exe

Filesize
507KB

MD5
4a5be7a889e7b8bee25a7a45f3597ffa

SHA1
f26b00262acd819e0e6aabfb1098bb7f00fdd2f1

SHA256
721f48c2044a14c1fc52f37e99f13b434e5b9fba2ad2c7094d620d7671604471

SHA512
3cfc5f385d52ce25d1f009d4076d795d6a085a0229e916b27675b1fed5471846f34101b0a3595981b1bbc64732ff939ca12af0b49f35e7f266463bdc6e951796

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr221242.exe

Filesize
14KB

MD5
1544c73383f427947d145940b36650a3

SHA1
dbcc55186be51da29f197a50e39f0433989bb2eb

SHA256
fed82a6904aa4de85918c97ebf2bcdcf72c7b485d10079205110e3b9f8c7764f

SHA512
b692b9868695df5d51300b6159bd743e0bf9f7f134a538752041fa519190f2e95610562f83a8feb34ab85a9d396973e89726daf894ab536128d79820f4ae74f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku175441.exe

Filesize
426KB

MD5
32bfe2323562c0bdc7f93f0daee799c0

SHA1
1d9f6a19b518f098300a87f2c14fb51a7a4a4dc7

SHA256
e74a545a890019750868757892baf5c20635ad9e0b94a827cb51a90e2816cb62

SHA512
b7bbb4b89e46c666a2cfb6ba4ea79fa58d499c70a2d1d986c0f8e947a2a8066458fc2af32b30b1ecdb603d2a469d9752d6f2a6afda8ec1e370ed40359edc0887

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2876-15-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download
memory/2876-14-0x00007FF94BCB3000-0x00007FF94BCB5000-memory.dmp

Filesize
8KB

Download
memory/2924-2128-0x0000000000AE0000-0x0000000000B0E000-memory.dmp

Filesize
184KB

Download
memory/2924-2129-0x0000000001460000-0x0000000001466000-memory.dmp

Filesize
24KB

Download
memory/4244-65-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-57-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-23-0x00000000025B0000-0x0000000002616000-memory.dmp

Filesize
408KB

Download
memory/4244-27-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-25-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-24-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-45-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-87-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-85-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-83-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-81-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-79-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-77-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-75-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-73-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-69-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-67-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-21-0x0000000004C00000-0x0000000004C66000-memory.dmp

Filesize
408KB

Download
memory/4244-63-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-61-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-59-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-22-0x0000000004C70000-0x0000000005214000-memory.dmp

Filesize
5.6MB

Download
memory/4244-55-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-53-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-51-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-49-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-43-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-41-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-39-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-37-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-36-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-33-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-31-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-29-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-71-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-47-0x00000000025B0000-0x000000000260F000-memory.dmp

Filesize
380KB

Download
memory/4244-2104-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/4536-2117-0x00000000003F0000-0x0000000000420000-memory.dmp

Filesize
192KB

Download
memory/4536-2118-0x0000000000BB0000-0x0000000000BB6000-memory.dmp

Filesize
24KB

Download
memory/4536-2119-0x0000000005370000-0x0000000005988000-memory.dmp

Filesize
6.1MB

Download
memory/4536-2120-0x0000000004E60000-0x0000000004F6A000-memory.dmp

Filesize
1.0MB

Download
memory/4536-2121-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/4536-2122-0x0000000004DD0000-0x0000000004E0C000-memory.dmp

Filesize
240KB

Download
memory/4536-2123-0x0000000004F70000-0x0000000004FBC000-memory.dmp

Filesize
304KB

Download