healer | 7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe
Size

661KB
MD5

7f514482ee5ce057f3a39c769298a003
SHA1

cc65f838f9362ed185263b02541e24b98efc5102
SHA256

7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe
SHA512

afc496348442b14c09ddd6bcd80eccfd4e642e01e868db764aed2421bc48b04437ef148fe982ca55b45b714372b55d48e250ad4783ff5a78ac17e53af824322a
SSDEEP

12288:dMrcy90BLgtC6ZJT983Ndx3ppCUhhl2gwdL4I5pi4J6AhwtPzGODU:Ry6strZJOlpdhl2dL4Ir6ASP5Y

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b65-13.dat	healer
behavioral1/memory/1644-15-0x0000000000EA0000-0x0000000000EAA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr042179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr042179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr042179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr042179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr042179.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr042179.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2604-2105-0x0000000005540000-0x0000000005572000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b6a-2110.dat	family_redline
behavioral1/memory/4276-2118-0x0000000000FD0000-0x0000000001000000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b63-2127.dat	family_redline
behavioral1/memory/5352-2129-0x0000000000730000-0x000000000075E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	ku785009.exe

Executes dropped EXE 5 IoCs

pid	Process
3452	ziDW8785.exe
1644	jr042179.exe
2604	ku785009.exe
4276	1.exe
5352	lr847819.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr042179.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziDW8785.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5732	2604	WerFault.exe	101

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziDW8785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku785009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr847819.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1644	jr042179.exe
1644	jr042179.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	jr042179.exe
Token: SeDebugPrivilege	2604	ku785009.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3452	4692	7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe	85
PID 4692 wrote to memory of 3452	4692	7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe	85
PID 4692 wrote to memory of 3452	4692	7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe	85
PID 3452 wrote to memory of 1644	3452	ziDW8785.exe	86
PID 3452 wrote to memory of 1644	3452	ziDW8785.exe	86
PID 3452 wrote to memory of 2604	3452	ziDW8785.exe	101
PID 3452 wrote to memory of 2604	3452	ziDW8785.exe	101
PID 3452 wrote to memory of 2604	3452	ziDW8785.exe	101
PID 2604 wrote to memory of 4276	2604	ku785009.exe	106
PID 2604 wrote to memory of 4276	2604	ku785009.exe	106
PID 2604 wrote to memory of 4276	2604	ku785009.exe	106
PID 4692 wrote to memory of 5352	4692	7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe	111
PID 4692 wrote to memory of 5352	4692	7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe	111
PID 4692 wrote to memory of 5352	4692	7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe	111

C:\Users\Admin\AppData\Local\Temp\7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe
"C:\Users\Admin\AppData\Local\Temp\7b02c836e030176f456310e8b19e4699a554f37a0ed05e63a0db25f2ec6756fe.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDW8785.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDW8785.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr042179.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr042179.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku785009.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku785009.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 1380
      4⤵
      Program crash
      PID:5732
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr847819.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr847819.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2604 -ip 2604
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr847819.exe

Filesize
168KB

MD5
6a407af37812b7a12fdaf86b5595a505

SHA1
52727d4fb2796a86dfc54fbcc01f854191eb3072

SHA256
d6cdabc414464f66965707973e8e8d8923f31cbd1e93f8d3c407bc9289503a4a

SHA512
9a3d8f784d915597d0a0d510a03dc5b0ed9bea7218d511abc85713b9201881a45cf8560abda8faad44daaafc1439798d8bb368875de976f23973293d9d2ba1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDW8785.exe

Filesize
507KB

MD5
3b77cccbb10ee235eafb1033a35e8f6d

SHA1
9df90831ef0b3e58bb698010984f308ac488af26

SHA256
e1287cf77230e8fe802d60adb8c8ef205317b6284a1b1917861f36b48b0f0645

SHA512
d1d737e814c54efb1544561dba6cf1ec03ec208c014616e33ec75c47217ddbe7b5608f3e107b489ba2d66e69ebcdf611e9fc1bc78217a406f8bfedf5e79f93d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr042179.exe

Filesize
15KB

MD5
f3aa8beeabea78e35c65ad62765d5a8b

SHA1
81a93efa86f6e8e9c9799b069d572ceedbe4a420

SHA256
360167d6fc5efe05e72f684a4bab5b8127aef46c7c4ea86f3ef873d60e5f03d2

SHA512
b615a95dbbf68b05b3c568816dcf3c7241355afa3ed54e7452c4fb1b01305422b803417cd109b75122a72839bc6cb80b93bba9169e0578caa7887b33950501cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku785009.exe

Filesize
426KB

MD5
02d570b63ae23f25170f9afc4bd237dd

SHA1
8cca768b2639b9496ef56fc507207d27eadd8eef

SHA256
cc1dedaa8668daa44e449dce04f540a64c3a77071559addfb5cdfa39fd76e2cc

SHA512
57119287f5dee58e1fdbd4388c5ba95ce04455b03970c595d3679df5046334c53989cfc4a786d7155d810b72de21b147ac5bb8f53f44832f227582eaaed4f53b

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1644-14-0x00007FFDD2753000-0x00007FFDD2755000-memory.dmp

Filesize
8KB

Download
memory/1644-15-0x0000000000EA0000-0x0000000000EAA000-memory.dmp

Filesize
40KB

Download
memory/1644-16-0x00007FFDD2753000-0x00007FFDD2755000-memory.dmp

Filesize
8KB

Download
memory/2604-22-0x0000000004D30000-0x0000000004D96000-memory.dmp

Filesize
408KB

Download
memory/2604-23-0x0000000004DA0000-0x0000000005344000-memory.dmp

Filesize
5.6MB

Download
memory/2604-24-0x0000000004BC0000-0x0000000004C26000-memory.dmp

Filesize
408KB

Download
memory/2604-30-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-36-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-88-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-86-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-84-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-82-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-80-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-76-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-74-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-72-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-70-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-68-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-66-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-64-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-60-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-58-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-56-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-54-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-52-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-50-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-48-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-44-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-42-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-40-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-38-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-34-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-32-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-78-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-62-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-46-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-28-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-26-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-25-0x0000000004BC0000-0x0000000004C1F000-memory.dmp

Filesize
380KB

Download
memory/2604-2105-0x0000000005540000-0x0000000005572000-memory.dmp

Filesize
200KB

Download
memory/4276-2118-0x0000000000FD0000-0x0000000001000000-memory.dmp

Filesize
192KB

Download
memory/4276-2119-0x0000000003220000-0x0000000003226000-memory.dmp

Filesize
24KB

Download
memory/4276-2120-0x0000000005F30000-0x0000000006548000-memory.dmp

Filesize
6.1MB

Download
memory/4276-2121-0x0000000005A20000-0x0000000005B2A000-memory.dmp

Filesize
1.0MB

Download
memory/4276-2122-0x0000000005950000-0x0000000005962000-memory.dmp

Filesize
72KB

Download
memory/4276-2123-0x00000000059B0000-0x00000000059EC000-memory.dmp

Filesize
240KB

Download
memory/4276-2124-0x0000000005B30000-0x0000000005B7C000-memory.dmp

Filesize
304KB

Download
memory/5352-2129-0x0000000000730000-0x000000000075E000-memory.dmp

Filesize
184KB

Download
memory/5352-2130-0x0000000002A20000-0x0000000002A26000-memory.dmp

Filesize
24KB

Download