healer | 9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7.exe
Size

530KB
MD5

698b616c71808ba6c066df7a383bf74a
SHA1

5a09d95299a804399523ed001cef8ae14159ed65
SHA256

9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7
SHA512

266e547ba40aa404b70bf7bccd9979e00e7fe4c831905e395b6b269a5b33e78caa1162f466f94b500276d950e118c894310294c062a8914adffce442a865ca9c
SSDEEP

12288:BMr8y90rjes006cjKi2jKuBgoE8lxLbHaYYy:5yOj7icjKizoE8PLOYYy

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b99-12.dat	healer
behavioral1/memory/4348-15-0x00000000008F0000-0x00000000008FA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr647861.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr647861.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr647861.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr647861.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr647861.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr647861.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/956-22-0x0000000004A80000-0x0000000004AC6000-memory.dmp	family_redline
behavioral1/memory/956-24-0x0000000004D60000-0x0000000004DA4000-memory.dmp	family_redline
behavioral1/memory/956-34-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-38-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-36-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-88-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-70-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-60-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-44-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-32-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-30-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-28-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-26-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-25-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-86-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-84-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-82-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-80-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-78-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-76-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-74-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-72-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-68-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-66-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-65-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-62-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-58-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-56-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-54-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-52-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-50-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-48-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-46-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-42-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline
behavioral1/memory/956-40-0x0000000004D60000-0x0000000004D9F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
908	zizd4622.exe
4348	jr647861.exe
956	ku760993.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr647861.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zizd4622.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zizd4622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku760993.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	jr647861.exe
4348	jr647861.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	jr647861.exe
Token: SeDebugPrivilege	956	ku760993.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 908	2504	9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7.exe	83
PID 2504 wrote to memory of 908	2504	9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7.exe	83
PID 2504 wrote to memory of 908	2504	9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7.exe	83
PID 908 wrote to memory of 4348	908	zizd4622.exe	84
PID 908 wrote to memory of 4348	908	zizd4622.exe	84
PID 908 wrote to memory of 956	908	zizd4622.exe	92
PID 908 wrote to memory of 956	908	zizd4622.exe	92
PID 908 wrote to memory of 956	908	zizd4622.exe	92

C:\Users\Admin\AppData\Local\Temp\9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7.exe
"C:\Users\Admin\AppData\Local\Temp\9677ba890800cdbdc1e903516d69ec09c3d6cdaf2380fe65871b3d83404e8cd7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizd4622.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizd4622.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr647861.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr647861.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku760993.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku760993.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizd4622.exe

Filesize
388KB

MD5
b43466d0494cbed0e1bf1ebe62ee190e

SHA1
b5e7665ab5d7ce90c409eb0a00a05d3a69f9be53

SHA256
2cd5b9256f1d0f8139ffd92458c0eb02045ffbe31ad113a6b9ecedc50d5a24ee

SHA512
873c11eae7bf775e971e850378807d1f04613c2b19e3e87abb184ff26cd59c4d43aac7d579d36e0f190ce6ef96b8a5c535401aa366c138fcac9ea63d2edf6cb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr647861.exe

Filesize
11KB

MD5
f0ffdb8653d6cd339552f9cba51d877b

SHA1
3051496ef460abbb58f80aa5d300e5ebc9555486

SHA256
272a3052425e4d9fb6aaa59bde6d6e463312dbac3dd436cae197ca6abdaf50bd

SHA512
5fb9acd2feda43d61583b8c5638078da9c275e0fe72ce4486f27bfb1628c8ceb6e3d7bbeafb2e84025216ddb07d32c6183f72546d3726b169f2bec4a0ca6b9ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku760993.exe

Filesize
354KB

MD5
0b44f279ef53a7894efd810e3c1bf1b2

SHA1
ae5e7e969a85aafe937d135d2b4a615439c9d695

SHA256
c1a67c6d04ba34f150e8606c5ef028af24acc464b88983e42b5449098ac75be7

SHA512
89bdd25c6131fa8822ae83ec60075e14ccfa0ab8eeaa97354ae9dabdbf07b6140f716a33d30fcc185fb924888e950f839d54390e7cd5353bef7bcb84c1b92bfb

Download Submit
memory/956-84-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-56-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-935-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download
memory/956-22-0x0000000004A80000-0x0000000004AC6000-memory.dmp

Filesize
280KB

Download
memory/956-23-0x0000000007230000-0x00000000077D4000-memory.dmp

Filesize
5.6MB

Download
memory/956-24-0x0000000004D60000-0x0000000004DA4000-memory.dmp

Filesize
272KB

Download
memory/956-34-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-38-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-36-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-88-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-70-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-60-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-44-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-32-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-30-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-28-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-26-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-25-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-86-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-934-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

Filesize
240KB

Download
memory/956-78-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-933-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/956-80-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-76-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-74-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-72-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-68-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-66-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-65-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-62-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-58-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-82-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-54-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-52-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-50-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-48-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-46-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-42-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-40-0x0000000004D60000-0x0000000004D9F000-memory.dmp

Filesize
252KB

Download
memory/956-931-0x00000000077E0000-0x0000000007DF8000-memory.dmp

Filesize
6.1MB

Download
memory/956-932-0x0000000007E60000-0x0000000007F6A000-memory.dmp

Filesize
1.0MB

Download
memory/4348-16-0x00007FFF14CB3000-0x00007FFF14CB5000-memory.dmp

Filesize
8KB

Download
memory/4348-14-0x00007FFF14CB3000-0x00007FFF14CB5000-memory.dmp

Filesize
8KB

Download
memory/4348-15-0x00000000008F0000-0x00000000008FA000-memory.dmp

Filesize
40KB

Download