healer | 4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b.exe
Size

925KB
MD5

952c28ab7325ab2d2ae8ae47903af738
SHA1

7e78f885f2c4ed0afdfb3d0bfd534b4eb94bdf36
SHA256

4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b
SHA512

35f106da80082902f2ee86af8be4e4a5eef391ea23514902845e8bec0ba0ed772634a3c731120141310ed71c55d17c785dcfdb0a60fcd82ba038e1f6fd876d93
SSDEEP

24576:myRRgduvGvIUxnrrWOlKuM4IgzutZmu2sP:1fgpAUxrxVMjDtwu

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023bf7-19.dat	healer
behavioral1/memory/2888-22-0x0000000000C40000-0x0000000000C4A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it173232.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it173232.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it173232.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it173232.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it173232.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it173232.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/5112-2112-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
behavioral1/files/0x0002000000022a9d-2117.dat	family_redline
behavioral1/memory/3732-2125-0x0000000000F90000-0x0000000000FC0000-memory.dmp	family_redline
behavioral1/files/0x0008000000023bf1-2134.dat	family_redline
behavioral1/memory/2808-2136-0x0000000000F60000-0x0000000000F8E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	jr798138.exe

Executes dropped EXE 6 IoCs

pid	Process
3564	zimk2515.exe
3844	zini0289.exe
2888	it173232.exe
5112	jr798138.exe
3732	1.exe
2808	kp532651.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it173232.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zimk2515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zini0289.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3468	5112	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zimk2515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zini0289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jr798138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kp532651.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2888	it173232.exe
2888	it173232.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	it173232.exe
Token: SeDebugPrivilege	5112	jr798138.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3564	4556	4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b.exe	83
PID 4556 wrote to memory of 3564	4556	4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b.exe	83
PID 4556 wrote to memory of 3564	4556	4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b.exe	83
PID 3564 wrote to memory of 3844	3564	zimk2515.exe	84
PID 3564 wrote to memory of 3844	3564	zimk2515.exe	84
PID 3564 wrote to memory of 3844	3564	zimk2515.exe	84
PID 3844 wrote to memory of 2888	3844	zini0289.exe	86
PID 3844 wrote to memory of 2888	3844	zini0289.exe	86
PID 3844 wrote to memory of 5112	3844	zini0289.exe	90
PID 3844 wrote to memory of 5112	3844	zini0289.exe	90
PID 3844 wrote to memory of 5112	3844	zini0289.exe	90
PID 5112 wrote to memory of 3732	5112	jr798138.exe	91
PID 5112 wrote to memory of 3732	5112	jr798138.exe	91
PID 5112 wrote to memory of 3732	5112	jr798138.exe	91
PID 3564 wrote to memory of 2808	3564	zimk2515.exe	96
PID 3564 wrote to memory of 2808	3564	zimk2515.exe	96
PID 3564 wrote to memory of 2808	3564	zimk2515.exe	96

C:\Users\Admin\AppData\Local\Temp\4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b.exe
"C:\Users\Admin\AppData\Local\Temp\4d0dfe85e970f9b2d2a8774d122fa417640aa08ab86f6627d57ec85b2406100b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimk2515.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimk2515.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zini0289.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zini0289.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it173232.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it173232.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr798138.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr798138.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 1484
        5⤵
        Program crash
        
        PID:3468
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp532651.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp532651.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5112 -ip 5112
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimk2515.exe

Filesize
661KB

MD5
786f77ccadd7161e670bff467d1212fc

SHA1
bdd7c57d3873994f3d6199842b4a871b8228a647

SHA256
e7f9f099f1ef0650dea2b156569e6cd861b30d8b1aab6cbe720f308bcb0a6d9d

SHA512
3ce3a5a01ed18f204498ce99a453e75a70d9b9c715c276c1f54cca1c90d9d0cfe4110d5d68dd403b0d8ef844849b25e97e4312a1bce0c482e53f4f60898cb683

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp532651.exe

Filesize
168KB

MD5
d276f563615a15a6b7de139aac16c5c7

SHA1
9d75aaa401fb547afd98832319ef2df938321de5

SHA256
8d34a945187ec390504e39b0c0e1cbfc89c608185b43ee6028e10a95e1f060c9

SHA512
f9b6417547877e51ef832a4a07028da2c84ef83dc68d294c6fff62e4af2fb2458bab58ceae63339d98fe5bdcc7a63b1a70b97d54778df88a1c204398273e97d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zini0289.exe

Filesize
507KB

MD5
8b7e58b6460794795162f3529234dad1

SHA1
3736545331f006b57893c5c38f113b9034f98161

SHA256
6fdd4f326ac600400cff0d7f6ad33e4489715178bc630941a31090e2a83935cc

SHA512
cb9558a0059ed8e0d820ff8de67ee6fffedb09f00f9a5b7a1d371d6c18eba9779514999562c1a9fe164790898bf895f1ab8f9158d9f463bafa822a0aa11cf19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it173232.exe

Filesize
15KB

MD5
9721707d1c4f8a05e6bacc23a38036b2

SHA1
f0eebc15cda33a65ae70a54215e831a645e39eaf

SHA256
e186adaf253266151e0b3bc3bf4673f86325e867ee2bac70b502aec5d686cf37

SHA512
dda8ff8f7c36e9ce8098eb6628c349c05f8124013619d457633d813d586f26ad49e22b499442b423477452e3cc803f1ca65a75f6fca17c4e4ea17792a98a6cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr798138.exe

Filesize
426KB

MD5
5c8352f57d299b3561c0df690b906cf1

SHA1
ab81fae8364f3632b3801f76116408e3b7e9de36

SHA256
91c534e8dd11480154bc82a3e6c67867881d6aeff8877a429e1f7da7927b5da7

SHA512
736da9100cc30c416f1d131589b246fa0e73cc0c996357b47d6daa875d3fa6ad46438be5f6233f723170a74e52cf24197585955d87877ed5c530b37c7365efc5

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2808-2136-0x0000000000F60000-0x0000000000F8E000-memory.dmp

Filesize
184KB

Download
memory/2808-2137-0x00000000031D0000-0x00000000031D6000-memory.dmp

Filesize
24KB

Download
memory/2888-23-0x00007FF98C133000-0x00007FF98C135000-memory.dmp

Filesize
8KB

Download
memory/2888-22-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/2888-21-0x00007FF98C133000-0x00007FF98C135000-memory.dmp

Filesize
8KB

Download
memory/3732-2125-0x0000000000F90000-0x0000000000FC0000-memory.dmp

Filesize
192KB

Download
memory/3732-2126-0x00000000057B0000-0x00000000057B6000-memory.dmp

Filesize
24KB

Download
memory/3732-2127-0x0000000005F40000-0x0000000006558000-memory.dmp

Filesize
6.1MB

Download
memory/3732-2131-0x00000000059C0000-0x0000000005A0C000-memory.dmp

Filesize
304KB

Download
memory/3732-2130-0x0000000005940000-0x000000000597C000-memory.dmp

Filesize
240KB

Download
memory/3732-2129-0x0000000005920000-0x0000000005932000-memory.dmp

Filesize
72KB

Download
memory/3732-2128-0x0000000005A30000-0x0000000005B3A000-memory.dmp

Filesize
1.0MB

Download
memory/5112-71-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-41-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-91-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-90-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-87-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-83-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-79-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-75-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-96-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-67-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-59-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-57-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-55-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-53-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-51-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-49-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-47-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-45-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-43-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-93-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-39-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-85-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-81-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-77-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-73-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-69-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-63-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-35-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-37-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-61-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-31-0x00000000051B0000-0x0000000005216000-memory.dmp

Filesize
408KB

Download
memory/5112-30-0x0000000004BC0000-0x0000000005164000-memory.dmp

Filesize
5.6MB

Download
memory/5112-29-0x0000000002450000-0x00000000024B6000-memory.dmp

Filesize
408KB

Download
memory/5112-65-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-33-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-32-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/5112-2112-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download