healer | 6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe
Size

660KB
MD5

64a4e65a34086717312b517202d15f61
SHA1

ed52fc014573c10b4bca47ebfbb3288929eb5428
SHA256

6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785
SHA512

386e41bf368dd0eaa6cbe92f84a2158b19de257815d5fd1a53ca3024bfe5a465bee8bc9c36377c587e8814bf80c9dbc6f0190f956a6d83afd97e59e122e2dcf3
SSDEEP

12288:VMrey90Ly6h5jEVL9e1a9dmBZ12kAB/nPTecUCZdPCPyqbuT8+7rink2dbCh:zymy6DNBZrgPfZKy/Z2pM

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023c9f-12.dat	healer
behavioral1/memory/2872-15-0x0000000000B50000-0x0000000000B5A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr665784.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr665784.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr665784.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr665784.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr665784.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr665784.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2272-2105-0x0000000005540000-0x0000000005572000-memory.dmp	family_redline
behavioral1/files/0x0007000000023ca5-2110.dat	family_redline
behavioral1/memory/5704-2118-0x0000000000FB0000-0x0000000000FE0000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c9d-2127.dat	family_redline
behavioral1/memory/5760-2129-0x0000000000BD0000-0x0000000000BFE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	ku255938.exe

Executes dropped EXE 5 IoCs

pid	Process
528	zisL4217.exe
2872	jr665784.exe
2272	ku255938.exe
5704	1.exe
5760	lr232537.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr665784.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zisL4217.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
800	2272	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zisL4217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku255938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr232537.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	jr665784.exe
2872	jr665784.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	jr665784.exe
Token: SeDebugPrivilege	2272	ku255938.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 528	3720	6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe	83
PID 3720 wrote to memory of 528	3720	6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe	83
PID 3720 wrote to memory of 528	3720	6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe	83
PID 528 wrote to memory of 2872	528	zisL4217.exe	84
PID 528 wrote to memory of 2872	528	zisL4217.exe	84
PID 528 wrote to memory of 2272	528	zisL4217.exe	101
PID 528 wrote to memory of 2272	528	zisL4217.exe	101
PID 528 wrote to memory of 2272	528	zisL4217.exe	101
PID 2272 wrote to memory of 5704	2272	ku255938.exe	105
PID 2272 wrote to memory of 5704	2272	ku255938.exe	105
PID 2272 wrote to memory of 5704	2272	ku255938.exe	105
PID 3720 wrote to memory of 5760	3720	6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe	110
PID 3720 wrote to memory of 5760	3720	6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe	110
PID 3720 wrote to memory of 5760	3720	6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe	110

C:\Users\Admin\AppData\Local\Temp\6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe
"C:\Users\Admin\AppData\Local\Temp\6260571fce8ddcb03ada69503152ff062a9c7366080ee903ba32dabe7c6bb785.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisL4217.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisL4217.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr665784.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr665784.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku255938.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku255938.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1496
      4⤵
      Program crash
      PID:800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr232537.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr232537.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2272 -ip 2272
1⤵
PID:5564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr232537.exe

Filesize
168KB

MD5
aaea3e2912812b99a151958c80da7810

SHA1
364734e2c22cff36887e0eff5fb556de6df7916d

SHA256
23b5c8bcd414638ccddd06f7f7291fac4dd1dbf4509df03a0f02413af31e0e7d

SHA512
521d718149ca5b5f742bbede21ec27a2413ef7fddd579edbc39b508b99b25a1e3258ce0f1b7c9efb1ea45761a29b677ac980f3cd7e1e23396ac58731f942787b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisL4217.exe

Filesize
507KB

MD5
6fe8f43a4c8300aa5170987b583b2edb

SHA1
4b2e3886dd4804cc242c21687f7260615c0029ae

SHA256
16f50371c16193142a013c049ee88a04fe646e5b4b4e8a3036af153800c03ad7

SHA512
871e54dd82e33f06151381f357997b9c915ed52bf04368dc5fa904988e47c211908dfd641e2e1ea72a4f07021d028be75793160da09afaa11d365ecfc815562d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr665784.exe

Filesize
14KB

MD5
e0d70e4fe2dc4c02265fc04b34ac0157

SHA1
92cd32c7e313317233e3b4859f11a60665179ea2

SHA256
07e65920c5e7fd464c3c8f0683356c4685fc91dd411f3b940e4fbf07cd87544d

SHA512
57477eafb86e6a45e0b5ff7469da5b3113adc94f20f2307a42e0b563974831ec651e67aa0c37fbbbdd3a2b970ef45b367ca356ec7cc1c70b1596d522b1e748be

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku255938.exe

Filesize
426KB

MD5
7cb9c54185187faa5fee3c70f112aace

SHA1
077530146de1087f42333c9a045681f1ac73bf27

SHA256
98a59c14d49a74ef734f0f86f6fbbde608b20d85280fae4074141be3d242bd67

SHA512
cb5db1cb8447faf54557a0127fd01b27b904f1f8b1e294f0c097d8106cdf02a03fb9c74327079e1c83ed96a95966d94908d0862187ea8c49f539398d3130e54d

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2272-58-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-25-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-24-0x0000000002710000-0x0000000002776000-memory.dmp

Filesize
408KB

Download
memory/2272-38-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-28-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-26-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-46-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-50-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-88-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-86-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-82-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-44-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-78-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-76-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-74-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-72-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-70-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-68-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-66-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-64-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-48-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-22-0x0000000002420000-0x0000000002486000-memory.dmp

Filesize
408KB

Download
memory/2272-56-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-54-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-62-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-23-0x0000000004E90000-0x0000000005434000-memory.dmp

Filesize
5.6MB

Download
memory/2272-80-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-42-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-40-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-36-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-34-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-32-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-30-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-84-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-60-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-52-0x0000000002710000-0x000000000276F000-memory.dmp

Filesize
380KB

Download
memory/2272-2105-0x0000000005540000-0x0000000005572000-memory.dmp

Filesize
200KB

Download
memory/2872-14-0x00007FFBB4AE3000-0x00007FFBB4AE5000-memory.dmp

Filesize
8KB

Download
memory/2872-15-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/2872-16-0x00007FFBB4AE3000-0x00007FFBB4AE5000-memory.dmp

Filesize
8KB

Download
memory/5704-2118-0x0000000000FB0000-0x0000000000FE0000-memory.dmp

Filesize
192KB

Download
memory/5704-2119-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/5704-2120-0x0000000005F70000-0x0000000006588000-memory.dmp

Filesize
6.1MB

Download
memory/5704-2121-0x0000000005A60000-0x0000000005B6A000-memory.dmp

Filesize
1.0MB

Download
memory/5704-2122-0x0000000005820000-0x0000000005832000-memory.dmp

Filesize
72KB

Download
memory/5704-2123-0x0000000005990000-0x00000000059CC000-memory.dmp

Filesize
240KB

Download
memory/5704-2124-0x00000000059E0000-0x0000000005A2C000-memory.dmp

Filesize
304KB

Download
memory/5760-2129-0x0000000000BD0000-0x0000000000BFE000-memory.dmp

Filesize
184KB

Download
memory/5760-2130-0x00000000053B0000-0x00000000053B6000-memory.dmp

Filesize
24KB

Download