healer | dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24

Analysis

max time kernel
116s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24.exe
Size

522KB
MD5

3fc4b1b49c7e52b4d6c611d4384849eb
SHA1

38627c90bb175491cec6a1c23c97324ad4f718ff
SHA256

dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24
SHA512

b23a61c65c14ab23c2f7c277ece5c4f095736d24b2f3af344574fb7ce65473c2b8c236e987328fa4e0fdc8ca563cc9f8bd3b641bf709151f20fa0c1c42ee731c
SSDEEP

12288:IMrRy90T7+heYfaBrwJ0M8Gz44IzW7wKovolU8ID:ZyC7+MYfYl9GM4B7fBID

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b74-12.dat	healer
behavioral1/memory/1888-15-0x0000000000690000-0x000000000069A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr550303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr550303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr550303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr550303.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr550303.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr550303.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/1652-22-0x0000000004BC0000-0x0000000004C06000-memory.dmp	family_redline
behavioral1/memory/1652-24-0x0000000005220000-0x0000000005264000-memory.dmp	family_redline
behavioral1/memory/1652-52-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-54-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-88-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-86-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-84-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-82-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-80-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-76-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-74-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-72-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-70-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-68-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-66-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-62-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-60-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-58-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-56-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-50-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-48-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-46-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-44-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-42-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-38-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-36-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-34-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-32-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-78-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-64-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-40-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-30-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-28-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-26-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline
behavioral1/memory/1652-25-0x0000000005220000-0x000000000525F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3912	ziwq1508.exe
1888	jr550303.exe
1652	ku236824.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr550303.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziwq1508.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziwq1508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku236824.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	jr550303.exe
1888	jr550303.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	jr550303.exe
Token: SeDebugPrivilege	1652	ku236824.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3912	4588	dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24.exe	83
PID 4588 wrote to memory of 3912	4588	dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24.exe	83
PID 4588 wrote to memory of 3912	4588	dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24.exe	83
PID 3912 wrote to memory of 1888	3912	ziwq1508.exe	84
PID 3912 wrote to memory of 1888	3912	ziwq1508.exe	84
PID 3912 wrote to memory of 1652	3912	ziwq1508.exe	98
PID 3912 wrote to memory of 1652	3912	ziwq1508.exe	98
PID 3912 wrote to memory of 1652	3912	ziwq1508.exe	98

C:\Users\Admin\AppData\Local\Temp\dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24.exe
"C:\Users\Admin\AppData\Local\Temp\dad83fc4644ce757857d1c690f8f844eec0aba0c12db202ca997c214f9166c24.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwq1508.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwq1508.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr550303.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr550303.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku236824.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku236824.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziwq1508.exe

Filesize
380KB

MD5
5ca88998c41b0a119d15b4d6cd5992ca

SHA1
677648e25f69648c10600dcbe51343c453673ae5

SHA256
ec6c3523d9185488651c66a47870f93b9b7db6213e7fa61952e1c2eda6d9e3aa

SHA512
4820d818aa985276851fac74a4615ace745b3e40d7122780bf0049df743f3f444af6b5910f6729557acce23f50df127d41b6d9c13a2a2017c7811577daf35961

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr550303.exe

Filesize
15KB

MD5
428c065b9fffccbcf36096967ddf4ad5

SHA1
11829475b871010c6daec6fca43067363852166a

SHA256
68db50c45ee96724ea04b734d3343845ce043368b9648d128d875537846445ef

SHA512
f55b11ca3e507c176fc9ce828306e825759f15070aa236a70c0b0113abaff61eedfa7b36c5338af2ec56a2e751fe48b5591d525f643256ceee39a50cc23b8c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku236824.exe

Filesize
294KB

MD5
5644f89947f3b7daae9eae5a0bb5ff5a

SHA1
37b24edebeb62e3b8425823aff4409b82a4ad165

SHA256
cd38d7df754a33924c69d4de764d0651d8e33467bc290ff5253af1947bacf917

SHA512
3f10baf6319b558dc773c75443a3ac4ce7fd36b826cc19c90381729302484d811a0275c3925d173fdd4800fef5bfc574f8cb9ff6a19f2315c9b6523f8c46fcd9

Download Submit
memory/1652-62-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-32-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-935-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Filesize
304KB

Download
memory/1652-22-0x0000000004BC0000-0x0000000004C06000-memory.dmp

Filesize
280KB

Download
memory/1652-23-0x0000000004C30000-0x00000000051D4000-memory.dmp

Filesize
5.6MB

Download
memory/1652-24-0x0000000005220000-0x0000000005264000-memory.dmp

Filesize
272KB

Download
memory/1652-52-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-54-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-88-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-86-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-84-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-82-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-80-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-76-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-74-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-72-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-70-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-68-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-66-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-934-0x0000000005A30000-0x0000000005A6C000-memory.dmp

Filesize
240KB

Download
memory/1652-56-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-933-0x0000000005A10000-0x0000000005A22000-memory.dmp

Filesize
72KB

Download
memory/1652-58-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-50-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-48-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-46-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-44-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-42-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-38-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-36-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-34-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-60-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-78-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-64-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-40-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-30-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-28-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-26-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-25-0x0000000005220000-0x000000000525F000-memory.dmp

Filesize
252KB

Download
memory/1652-931-0x0000000005260000-0x0000000005878000-memory.dmp

Filesize
6.1MB

Download
memory/1652-932-0x00000000058D0000-0x00000000059DA000-memory.dmp

Filesize
1.0MB

Download
memory/1888-16-0x00007FF94B553000-0x00007FF94B555000-memory.dmp

Filesize
8KB

Download
memory/1888-14-0x00007FF94B553000-0x00007FF94B555000-memory.dmp

Filesize
8KB

Download
memory/1888-15-0x0000000000690000-0x000000000069A000-memory.dmp

Filesize
40KB

Download