healer | 2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7.exe
Size

521KB
MD5

15043d3fdb28b84e2cd41d19581d22db
SHA1

04139ebacdc62abf5eac320afd453b1a1b8d6e91
SHA256

2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7
SHA512

42c4f0b9fa37739836a4b50347d954b1bf8d63de76990c78b5dcd19724a752dcdd9150be2f1dbb9f851ac6a9a0abd37c8754645ffd88751ff53c806f6c9a5b73
SSDEEP

12288:2Mr9y9083I74IkIR+qcURTYcuyZLk/bLgYOz:LyL3+4IvM5UBuyi/bLSz

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023ca2-12.dat	healer
behavioral1/memory/3544-15-0x00000000001A0000-0x00000000001AA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr760027.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr760027.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr760027.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr760027.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr760027.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr760027.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/3672-22-0x00000000023F0000-0x0000000002436000-memory.dmp	family_redline
behavioral1/memory/3672-24-0x0000000004A90000-0x0000000004AD4000-memory.dmp	family_redline
behavioral1/memory/3672-40-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-32-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-30-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-28-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-26-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-25-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-48-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-88-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-86-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-84-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-82-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-80-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-78-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-74-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-72-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-70-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-68-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-66-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-64-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-60-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-58-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-56-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-52-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-46-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-44-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-42-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-38-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-36-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-34-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-76-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-54-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/3672-50-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4512	ziYY1640.exe
3544	jr760027.exe
3672	ku305083.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr760027.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziYY1640.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5528	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziYY1640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku305083.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3544	jr760027.exe
3544	jr760027.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	jr760027.exe
Token: SeDebugPrivilege	3672	ku305083.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4512	4384	2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7.exe	83
PID 4384 wrote to memory of 4512	4384	2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7.exe	83
PID 4384 wrote to memory of 4512	4384	2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7.exe	83
PID 4512 wrote to memory of 3544	4512	ziYY1640.exe	85
PID 4512 wrote to memory of 3544	4512	ziYY1640.exe	85
PID 4512 wrote to memory of 3672	4512	ziYY1640.exe	93
PID 4512 wrote to memory of 3672	4512	ziYY1640.exe	93
PID 4512 wrote to memory of 3672	4512	ziYY1640.exe	93

C:\Users\Admin\AppData\Local\Temp\2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7.exe
"C:\Users\Admin\AppData\Local\Temp\2535a57915da267368b9dba6e60e0b84f3f2fbaa27c8de16d1a329199e7d78b7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYY1640.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYY1640.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr760027.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr760027.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku305083.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku305083.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3672

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:5528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYY1640.exe

Filesize
379KB

MD5
aa6146ad5cd633dcf80eb04b7b79aa8b

SHA1
f0b9841ceb8ec909ed505c0200c313920756ed89

SHA256
8c382911a8f06548829a79ca794695497e7384bca02f4ff16c6ef309e92f6390

SHA512
f3465cffb767f974a6852c160688e03c84a86706e02b58d62ea0f331d77154b4f73357e9ebf4cace389ad078a36f683059e70eb7185237e9fe500d793d35c456

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr760027.exe

Filesize
11KB

MD5
eead17d3376defc1b833e4f41378de64

SHA1
16cbe2843eb639e2ef9a6eb241abd1e319fc6665

SHA256
67efc7a9be0966299d6baf23eec28665784efeccce75a4e49b0901ae5b6b7c27

SHA512
60f7a06523779896c379bd4d1473c5e0199a1b075058737dc3c1ce72c07ff9f8000b29a91b0ff20e3df95db272224ce7f3052e192ce2a9d12cb7d4848bc26b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku305083.exe

Filesize
294KB

MD5
c4dcf9aa726c96ce0a593ab15fcc827c

SHA1
05545e4ce4fe5e29c3c31e09c90a8e907098b85d

SHA256
7e0d3fb2edea4936f93ce1de8aa2eb2eb4bf656a778b4d0ee64bcfdef9788e13

SHA512
f57084eb83dbf612f53adafd7014ff47d1b2abe64823e01e50f0c5ddc5e3dfa146cef1d5eeae7308600c92c654fdc96576bc9d2b5ecc010f3b6750c4a5d90346

Download Submit
memory/3544-15-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/3544-14-0x00007FFB68883000-0x00007FFB68885000-memory.dmp

Filesize
8KB

Download
memory/3544-16-0x00007FFB68883000-0x00007FFB68885000-memory.dmp

Filesize
8KB

Download
memory/3672-74-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-64-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-24-0x0000000004A90000-0x0000000004AD4000-memory.dmp

Filesize
272KB

Download
memory/3672-40-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-32-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-30-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-28-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-26-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-25-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-48-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-88-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-86-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-84-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-82-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-80-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-78-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-22-0x00000000023F0000-0x0000000002436000-memory.dmp

Filesize
280KB

Download
memory/3672-72-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-70-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-68-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-66-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-23-0x0000000004C20000-0x00000000051C4000-memory.dmp

Filesize
5.6MB

Download
memory/3672-60-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-58-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-56-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-52-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-46-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-44-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-42-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-38-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-36-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-34-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-76-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-54-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-50-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/3672-931-0x00000000051D0000-0x00000000057E8000-memory.dmp

Filesize
6.1MB

Download
memory/3672-932-0x00000000057F0000-0x00000000058FA000-memory.dmp

Filesize
1.0MB

Download
memory/3672-933-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3672-934-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/3672-935-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download