healer | 611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe
Size

655KB
MD5

9d0f603ee7462f13a7b1d37fda5763b5
SHA1

1f5a4e756560ef95bf80cd5d87474cd9bb421f6c
SHA256

611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338
SHA512

ee729ed1967827500127147359e3b70b51f26cd94ab6059a851e3ee9d810e810cbef2a0e9c486b28b7c4023149d832b40b6d25009ef6e8c28cc6abc42e0c44c8
SSDEEP

12288:FMrCy90CrvEEv3gw79IiEbxI9KMCumwdjwTG8ZnZI8+CuNfZ1eZh5eC:ryr8EJjEbxIsPwdj6G8hZI8+z1eZh5J

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b77-12.dat	healer
behavioral1/memory/1120-15-0x0000000000BD0000-0x0000000000BDA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr605481.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr605481.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr605481.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr605481.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr605481.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr605481.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/3332-2105-0x0000000005430000-0x0000000005462000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b7c-2110.dat	family_redline
behavioral1/memory/6900-2118-0x0000000000310000-0x0000000000340000-memory.dmp	family_redline
behavioral1/files/0x0031000000023b75-2128.dat	family_redline
behavioral1/memory/5660-2129-0x0000000000960000-0x000000000098E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	ku825820.exe

Executes dropped EXE 5 IoCs

pid	Process
2772	zikH4673.exe
1120	jr605481.exe
3332	ku825820.exe
6900	1.exe
5660	lr467421.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr605481.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zikH4673.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	3332	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zikH4673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku825820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr467421.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1120	jr605481.exe
1120	jr605481.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	jr605481.exe
Token: SeDebugPrivilege	3332	ku825820.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 2772	3800	611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe	83
PID 3800 wrote to memory of 2772	3800	611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe	83
PID 3800 wrote to memory of 2772	3800	611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe	83
PID 2772 wrote to memory of 1120	2772	zikH4673.exe	84
PID 2772 wrote to memory of 1120	2772	zikH4673.exe	84
PID 2772 wrote to memory of 3332	2772	zikH4673.exe	94
PID 2772 wrote to memory of 3332	2772	zikH4673.exe	94
PID 2772 wrote to memory of 3332	2772	zikH4673.exe	94
PID 3332 wrote to memory of 6900	3332	ku825820.exe	97
PID 3332 wrote to memory of 6900	3332	ku825820.exe	97
PID 3332 wrote to memory of 6900	3332	ku825820.exe	97
PID 3800 wrote to memory of 5660	3800	611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe	101
PID 3800 wrote to memory of 5660	3800	611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe	101
PID 3800 wrote to memory of 5660	3800	611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe	101

C:\Users\Admin\AppData\Local\Temp\611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe
"C:\Users\Admin\AppData\Local\Temp\611a118c9f9d861c33e3c34dd8e2060373994b25e8cafca1c76770d1a63f9338.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikH4673.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikH4673.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr605481.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr605481.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku825820.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku825820.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1188
      4⤵
      Program crash
      PID:1616
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr467421.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr467421.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3332 -ip 3332
1⤵
PID:7096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr467421.exe

Filesize
168KB

MD5
a9f1c9197f492a6f4fcbc9858f6b6a9b

SHA1
6a931fbd35a1f2a4ccec3093b6187f9e6ea9ac5e

SHA256
ec68ac4d6d00420b612c019d3db81fef9f8c83ff812412cd114b8fa60a60ece3

SHA512
f9781cc1f30b37fe55fd783f3513e45c471785ee5ce55702c3337722e512ddb521be0bda33d8fc19d58eedb274dbe8992267542fff874468c7bf41877e00c4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikH4673.exe

Filesize
501KB

MD5
29bf1c22f7f4657d6a65623233271476

SHA1
07e65a0f5cf2aa01970e94d4a6a7067350c8c44b

SHA256
c981f1a4c8d5676bf57730f1aa338f76c0e5f6cb736b4945674ae9fbf45d14ff

SHA512
a90b1170f2c24abd6ec5b992c669747f0cc028105ef7a019227372eecd863bff6616642a33b67e85327a4ffc54137f21180dbe1af8b9d47461bafbf1e00f2fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr605481.exe

Filesize
11KB

MD5
75e1a0605324025755d798b655616ec5

SHA1
ef6391401b0d282c56ff44624203b0e17516e23e

SHA256
c214e739f12101817cfd7cd89e075db874b3c36e720ecf38dd2d426e9c188334

SHA512
43b69059baab2f94c0232eaab6047c4a02cd296854a2a185c80e1e0b41d3055e11b424a9e3b2b99c7bae1428fdc3b7834516ef8c41b67d2ddb8e9ca08af1f108

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku825820.exe

Filesize
424KB

MD5
315a3d7e32590fe4df79f96b6645c1cb

SHA1
625b3a3169325f15b587989aa6032543aeeacd1f

SHA256
b5b5ff7c360bcdc8f40ceb4dd6af42a43aec4882fa13bb0cd482aa85984ce472

SHA512
c67ddf542a54bb11e4b4eec1f96e2ab9871bfa40a261b0f77d702a1ee284e7bae5b51cc622578104939ee4d555287a5ef67be1ee18967193b88c66a408bac2c9

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1120-14-0x00007FFF47C63000-0x00007FFF47C65000-memory.dmp

Filesize
8KB

Download
memory/1120-15-0x0000000000BD0000-0x0000000000BDA000-memory.dmp

Filesize
40KB

Download
memory/1120-16-0x00007FFF47C63000-0x00007FFF47C65000-memory.dmp

Filesize
8KB

Download
memory/3332-66-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-56-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-24-0x0000000005260000-0x00000000052C6000-memory.dmp

Filesize
408KB

Download
memory/3332-26-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-84-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-40-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-28-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-25-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-88-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-86-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-82-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-80-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-78-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-76-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-74-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-72-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-70-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-68-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-22-0x0000000004AF0000-0x0000000004B56000-memory.dmp

Filesize
408KB

Download
memory/3332-64-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-62-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-60-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-58-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-23-0x0000000004CB0000-0x0000000005254000-memory.dmp

Filesize
5.6MB

Download
memory/3332-54-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-52-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-50-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-48-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-46-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-44-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-42-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-38-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-36-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-34-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-32-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-30-0x0000000005260000-0x00000000052BF000-memory.dmp

Filesize
380KB

Download
memory/3332-2105-0x0000000005430000-0x0000000005462000-memory.dmp

Filesize
200KB

Download
memory/5660-2129-0x0000000000960000-0x000000000098E000-memory.dmp

Filesize
184KB

Download
memory/5660-2130-0x00000000075D0000-0x00000000075D6000-memory.dmp

Filesize
24KB

Download
memory/6900-2118-0x0000000000310000-0x0000000000340000-memory.dmp

Filesize
192KB

Download
memory/6900-2119-0x0000000002580000-0x0000000002586000-memory.dmp

Filesize
24KB

Download
memory/6900-2120-0x0000000005290000-0x00000000058A8000-memory.dmp

Filesize
6.1MB

Download
memory/6900-2121-0x0000000004D80000-0x0000000004E8A000-memory.dmp

Filesize
1.0MB

Download
memory/6900-2122-0x0000000004C90000-0x0000000004CA2000-memory.dmp

Filesize
72KB

Download
memory/6900-2123-0x0000000004CF0000-0x0000000004D2C000-memory.dmp

Filesize
240KB

Download
memory/6900-2124-0x0000000004E90000-0x0000000004EDC000-memory.dmp

Filesize
304KB

Download