healer | 550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1.exe
Size

530KB
MD5

ff4b5da87d92d433ec485fbd14f251f7
SHA1

f96ee2ff329b52145b10938270ca9a5b2e4fb7a3
SHA256

550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1
SHA512

5f1509870c9fd36d54126426d7078060fddcec8d440860f3c1a26430f015d3a337d8fd8c1291815747dc92fef3fece4eb65fd5e0e5e15a9192cd49a11790d185
SSDEEP

12288:cMrIy90nYw0791It2CCRvIBpZf5KXa/wiDewzAMENmJDkA:0ylHItavINATiDewz3NkA

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b79-12.dat	healer
behavioral1/memory/4204-15-0x0000000000E80000-0x0000000000E8A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr167095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr167095.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr167095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr167095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr167095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr167095.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/1660-21-0x0000000002670000-0x00000000026B6000-memory.dmp	family_redline
behavioral1/memory/1660-23-0x0000000005180000-0x00000000051C4000-memory.dmp	family_redline
behavioral1/memory/1660-35-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-37-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-88-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-83-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-81-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-79-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-77-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-75-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-73-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-71-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-67-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-65-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-63-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-61-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-59-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-57-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-55-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-51-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-49-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-47-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-45-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-43-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-41-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-39-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-33-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-31-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-29-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-85-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-69-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-53-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-27-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-25-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline
behavioral1/memory/1660-24-0x0000000005180000-0x00000000051BF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4152	ziNH3007.exe
4204	jr167095.exe
1660	ku395743.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr167095.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziNH3007.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziNH3007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku395743.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	jr167095.exe
4204	jr167095.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	jr167095.exe
Token: SeDebugPrivilege	1660	ku395743.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4152	4896	550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1.exe	83
PID 4896 wrote to memory of 4152	4896	550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1.exe	83
PID 4896 wrote to memory of 4152	4896	550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1.exe	83
PID 4152 wrote to memory of 4204	4152	ziNH3007.exe	84
PID 4152 wrote to memory of 4204	4152	ziNH3007.exe	84
PID 4152 wrote to memory of 1660	4152	ziNH3007.exe	94
PID 4152 wrote to memory of 1660	4152	ziNH3007.exe	94
PID 4152 wrote to memory of 1660	4152	ziNH3007.exe	94

C:\Users\Admin\AppData\Local\Temp\550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1.exe
"C:\Users\Admin\AppData\Local\Temp\550b100ea4279414707c6ee0356ce078a79d7592404c5d2dd7b7fb56eaca44b1.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH3007.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH3007.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr167095.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr167095.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku395743.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku395743.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNH3007.exe

Filesize
388KB

MD5
f290eea7e54afd34c67615ca0162f021

SHA1
daec4ca538f63221b73819df97a5350a52bc1a9a

SHA256
1c366cfd9c893862b78a5f84fe235652fd61164984fe9b24cd8499da81a28770

SHA512
ff20cf01d0fede697b71e8ddb5ef3641c8f892f851150d77874e1852384f8c6512b21e13fac6f8028d146bd93c45137ee0da65ba19c4f1eaa9f7102ad3c1c866

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr167095.exe

Filesize
11KB

MD5
2daf21140ef736623a838840c7d683c6

SHA1
9e44e8e94072bec6aee371de55a6ba5bd82d2129

SHA256
29d231389bb9d6ee847960edfbe9be3e4dd4e4910891c06052c31a0568aa10e6

SHA512
c48b3a4936ff03c838e047b5c623fbd2663a613af9fcd3d973fdd564e0819d977d2c86631319bb4dd4155b255cdca4328c6ee7370ccafae9159b880cd971c256

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku395743.exe

Filesize
434KB

MD5
8b879b693a05600bef02e5619e974731

SHA1
28cd88f15de73ab99dc4f2dd942e582cc9177175

SHA256
58122752d2f0979226891b65ee32de80999f8cb400d3aa4e3353e31d6eee9b18

SHA512
25e5cbef88c771cda25bbefdd45b76e928a4601bb8cc01dbeb664be7959efcf52d0464750ffc4b693c272de9e1dbbc24619baac8463b5cbf3a2e97877e5b9fd4

Download Submit
memory/1660-59-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-51-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-21-0x0000000002670000-0x00000000026B6000-memory.dmp

Filesize
280KB

Download
memory/1660-22-0x0000000004B90000-0x0000000005134000-memory.dmp

Filesize
5.6MB

Download
memory/1660-23-0x0000000005180000-0x00000000051C4000-memory.dmp

Filesize
272KB

Download
memory/1660-35-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-37-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-88-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-83-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-81-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-79-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-77-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-75-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-73-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-71-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-67-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-65-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-55-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-61-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-934-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Filesize
304KB

Download
memory/1660-933-0x0000000005B30000-0x0000000005B6C000-memory.dmp

Filesize
240KB

Download
memory/1660-57-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-63-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-49-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-47-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-45-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-43-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-41-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-39-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-33-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-31-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-29-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-85-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-69-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-53-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-27-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-25-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-24-0x0000000005180000-0x00000000051BF000-memory.dmp

Filesize
252KB

Download
memory/1660-930-0x0000000005330000-0x0000000005948000-memory.dmp

Filesize
6.1MB

Download
memory/1660-931-0x00000000059D0000-0x0000000005ADA000-memory.dmp

Filesize
1.0MB

Download
memory/1660-932-0x0000000005B10000-0x0000000005B22000-memory.dmp

Filesize
72KB

Download
memory/4204-15-0x0000000000E80000-0x0000000000E8A000-memory.dmp

Filesize
40KB

Download
memory/4204-14-0x00007FFB808E3000-0x00007FFB808E5000-memory.dmp

Filesize
8KB

Download