healer | ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe
Size

684KB
MD5

cbd9334297fc3a389acd0f9f08d99d8f
SHA1

f651c38c3a1dcffc93f71c9193f5952c9fed2e18
SHA256

ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731
SHA512

63eafc3676620f77f206158590434f4b4dacd8ac4555aad2cc044671e57b69661dac5af0e00144b8531ffa9e871a5ee0f9fd8b373d4459f7c93ed01be0698413
SSDEEP

12288:5MrEy90lVIl0KMp4dRza+9Y8ivte52M1eSZi5frSMJfW9js:ZyETOJS9l82R2MZfW6

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c9e-12.dat	healer
behavioral1/memory/4336-15-0x0000000000390000-0x000000000039A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr482688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr482688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr482688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr482688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr482688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr482688.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/952-2105-0x0000000005750000-0x0000000005782000-memory.dmp	family_redline
behavioral1/files/0x0008000000023c98-2110.dat	family_redline
behavioral1/memory/4528-2118-0x0000000000BD0000-0x0000000000C00000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c9c-2127.dat	family_redline
behavioral1/memory/3484-2129-0x00000000003B0000-0x00000000003DE000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	ku565801.exe

Executes dropped EXE 5 IoCs

pid	Process
5108	ziZS1355.exe
4336	jr482688.exe
952	ku565801.exe
4528	1.exe
3484	lr031959.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr482688.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziZS1355.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	952	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku565801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr031959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziZS1355.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4336	jr482688.exe
4336	jr482688.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	jr482688.exe
Token: SeDebugPrivilege	952	ku565801.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 5108	4372	ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe	83
PID 4372 wrote to memory of 5108	4372	ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe	83
PID 4372 wrote to memory of 5108	4372	ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe	83
PID 5108 wrote to memory of 4336	5108	ziZS1355.exe	84
PID 5108 wrote to memory of 4336	5108	ziZS1355.exe	84
PID 5108 wrote to memory of 952	5108	ziZS1355.exe	93
PID 5108 wrote to memory of 952	5108	ziZS1355.exe	93
PID 5108 wrote to memory of 952	5108	ziZS1355.exe	93
PID 952 wrote to memory of 4528	952	ku565801.exe	94
PID 952 wrote to memory of 4528	952	ku565801.exe	94
PID 952 wrote to memory of 4528	952	ku565801.exe	94
PID 4372 wrote to memory of 3484	4372	ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe	98
PID 4372 wrote to memory of 3484	4372	ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe	98
PID 4372 wrote to memory of 3484	4372	ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe	98

C:\Users\Admin\AppData\Local\Temp\ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe
"C:\Users\Admin\AppData\Local\Temp\ff5e59a11ed6f264983a4ea171f4396166660757abb541ed3a422026ff528731.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZS1355.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZS1355.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr482688.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr482688.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku565801.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku565801.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1172
      4⤵
      Program crash
      PID:2280
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr031959.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr031959.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 952 -ip 952
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr031959.exe

Filesize
169KB

MD5
98e020f70e2db41cd3ab58580179ad77

SHA1
1f76dfe8d155d8623ee8b9d3803561521845b227

SHA256
c9642fd2dbce94f4c1e24f229e7f6373538fd2a06d444b09c6300ef1c4ecf029

SHA512
64cede096e22196fd951239bbfc28d315b0e496739a78b0f651152bfb31870b2aad516fc39853a8c951352ebd1d97367e27f6dac2ab5fbdbe107e2e1dc648aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZS1355.exe

Filesize
530KB

MD5
6afb544f1aa8474f65275b23503e4d2a

SHA1
ad485fbae004db167ad1b8bce6e2a33ee0bd5b58

SHA256
eb306a76116c9fc3cc97f64fbbb7a241ce65cd01d9d615d783b2167345baa590

SHA512
3be4a99b824ce231865a2a90f609aa0584583260c3cc9a3847b8b4d47916b47f36357be889ffa928a9c38725f4ec195b96c6c0033a3e2e105b892e440a897d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr482688.exe

Filesize
12KB

MD5
a522c0bd25e610d4476a1c1ab5608012

SHA1
8a81965ee55d33ec14cc91e9545689e4304b01ac

SHA256
7145b074802cdb63953130b74772269b14c35f08c1c59878663d26fa9399c3c7

SHA512
fe3510f366c054b05a4d1b11482bd149879c4e38e7751f9e53de463089df4613cfba74e4f093b5e755ef22b344d97f4a8b39f55933f67ef274b7bcfc9c64f43f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku565801.exe

Filesize
495KB

MD5
4ede18a0cad0282a4622b587a2641f97

SHA1
039ac94e6c39a54ae8509f7021b1f0f1937d0004

SHA256
9a7acfa5365bd739bcd650a5ffd9601e82cf07d6d00df7cddc81389d7c3b2893

SHA512
446870ff46718762fe8dc7e6d0eef00bb98230edd8f42019d8ddeb447973436daece2a2a1924e4446d9ac0d99e9d7b5f9adbe1aeede85084e58a9ba1e86a20bb

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/952-54-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-58-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-24-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/952-44-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-48-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-88-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-86-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-85-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-82-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-80-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-78-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-76-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-74-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-70-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-68-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-66-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-64-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-62-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-60-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-42-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-56-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-22-0x0000000004E60000-0x0000000004EC6000-memory.dmp

Filesize
408KB

Download
memory/952-52-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-50-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-23-0x0000000004F30000-0x00000000054D4000-memory.dmp

Filesize
5.6MB

Download
memory/952-40-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-46-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-38-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-36-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-35-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-30-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-28-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-72-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-32-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-26-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-25-0x0000000005520000-0x000000000557F000-memory.dmp

Filesize
380KB

Download
memory/952-2105-0x0000000005750000-0x0000000005782000-memory.dmp

Filesize
200KB

Download
memory/3484-2130-0x00000000024B0000-0x00000000024B6000-memory.dmp

Filesize
24KB

Download
memory/3484-2129-0x00000000003B0000-0x00000000003DE000-memory.dmp

Filesize
184KB

Download
memory/4336-14-0x00007FFB33123000-0x00007FFB33125000-memory.dmp

Filesize
8KB

Download
memory/4336-16-0x00007FFB33123000-0x00007FFB33125000-memory.dmp

Filesize
8KB

Download
memory/4336-15-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download
memory/4528-2118-0x0000000000BD0000-0x0000000000C00000-memory.dmp

Filesize
192KB

Download
memory/4528-2120-0x0000000005C20000-0x0000000006238000-memory.dmp

Filesize
6.1MB

Download
memory/4528-2121-0x0000000005710000-0x000000000581A000-memory.dmp

Filesize
1.0MB

Download
memory/4528-2122-0x0000000005440000-0x0000000005452000-memory.dmp

Filesize
72KB

Download
memory/4528-2123-0x00000000054A0000-0x00000000054DC000-memory.dmp

Filesize
240KB

Download
memory/4528-2119-0x0000000002DA0000-0x0000000002DA6000-memory.dmp

Filesize
24KB

Download
memory/4528-2124-0x0000000005600000-0x000000000564C000-memory.dmp

Filesize
304KB

Download