healer | d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe
Size

661KB
MD5

fa5fa780f7a82f5480f4ab6d313495eb
SHA1

5a680201206197bee2020286f35f97e3bad85971
SHA256

d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c
SHA512

5ee403320defd50c36c218d89a0caf6d82fb481c1f7e26905f3f522de4f4ab8755aa29f4427c702913cdb37b500190ae4c0ab9f409e4e300e5c6e00847149245
SSDEEP

12288:EMrRy90bwAASvi4wfYQ+2VqbSclCX042o/lZslmTg7nvzjKyj0gzG:1yNAA7fLMbFlZXo/l1ivPK4zG

Score

10^/10

healer redline droz norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

77.91.124.145:4125

Attributes

auth_value
d099adf6dbf6ccb8e16967104280634a

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b73-12.dat	healer
behavioral1/memory/4812-15-0x0000000000250000-0x000000000025A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr676584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr676584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr676584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr676584.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr676584.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr676584.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2036-2105-0x0000000005540000-0x0000000005572000-memory.dmp	family_redline
behavioral1/files/0x0010000000023a1d-2110.dat	family_redline
behavioral1/memory/3136-2118-0x0000000000240000-0x0000000000270000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b71-2128.dat	family_redline
behavioral1/memory/3236-2129-0x0000000000E00000-0x0000000000E2E000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	ku632810.exe

Executes dropped EXE 5 IoCs

pid	Process
212	zitE1118.exe
4812	jr676584.exe
2036	ku632810.exe
3136	1.exe
3236	lr941205.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr676584.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zitE1118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5308	2036	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zitE1118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku632810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr941205.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	jr676584.exe
4812	jr676584.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	jr676584.exe
Token: SeDebugPrivilege	2036	ku632810.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 212	3492	d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe	83
PID 3492 wrote to memory of 212	3492	d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe	83
PID 3492 wrote to memory of 212	3492	d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe	83
PID 212 wrote to memory of 4812	212	zitE1118.exe	84
PID 212 wrote to memory of 4812	212	zitE1118.exe	84
PID 212 wrote to memory of 2036	212	zitE1118.exe	97
PID 212 wrote to memory of 2036	212	zitE1118.exe	97
PID 212 wrote to memory of 2036	212	zitE1118.exe	97
PID 2036 wrote to memory of 3136	2036	ku632810.exe	98
PID 2036 wrote to memory of 3136	2036	ku632810.exe	98
PID 2036 wrote to memory of 3136	2036	ku632810.exe	98
PID 3492 wrote to memory of 3236	3492	d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe	103
PID 3492 wrote to memory of 3236	3492	d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe	103
PID 3492 wrote to memory of 3236	3492	d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe	103

C:\Users\Admin\AppData\Local\Temp\d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe
"C:\Users\Admin\AppData\Local\Temp\d859a0548858048e0e6dc56fb0e6204767073ac6a8779feba95bd42d28e9481c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitE1118.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitE1118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr676584.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr676584.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku632810.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku632810.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 1528
      4⤵
      Program crash
      PID:5308
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr941205.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr941205.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2036 -ip 2036
1⤵
PID:5408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr941205.exe

Filesize
169KB

MD5
bba11e3bb4e503cc783e1221159e2a51

SHA1
96c6b3e6fb5c4f80f743abc9998e5b302517149f

SHA256
39a8e166fb7adf49854f8b44ad99cabcb3afd28012daad788f105f167bd10271

SHA512
0fa6a93d2dc4756d8d34f7543bde91324989cc93e12b5d890ea7c688e3bc20ad0412504bbe69d4dec34b0eb14f22f4071f6d70ec6df828254e4586350d6d58bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zitE1118.exe

Filesize
506KB

MD5
15ccab994dca49213d6825fbd22a37ba

SHA1
22fd69bc47a19849ece649a93cf7d8003ac428e8

SHA256
63308571d73da1a169f021edc8314968a1435213ffd383d08a1ec44ed7918e2a

SHA512
7911d64dd8aafa71b8ac320e9ab8bd64f6aacf82dbea66c58d40751f074bdaf274795984f6eec83cb7b0eb21cf2342fe12c5d67fa835de96d4c3cb64130db806

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr676584.exe

Filesize
15KB

MD5
96562bde0f0747348d98769807a9e2c1

SHA1
f0461b2f4c860952cd6f9ada2d4d7d85e94774c8

SHA256
daf85ccf41745930a9ab767cbbe9c43e668e6aac4a12430103c1dc8b28c29baf

SHA512
2ca199fbff478a70ce0f3ef5a60384ab3783940e120b181ab6f803f59fd0c18dc5c7ec56f85442ed2f75c3784378634e0618443343fc5dbb7fe2d25f2bd5db70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku632810.exe

Filesize
426KB

MD5
859d9c41a135c1d2e4111d42bd9b44cb

SHA1
7444c889a15a344f4fd01b292a4661a34282e325

SHA256
ae1bde44a630297432d533c7ba958d963b0c59089692e06ade89163c8bb1e950

SHA512
2da9c9fef0acccb45314d0a592a9f654d77f87f303a16b1ad995fd5a5d9a2b057166f22d81ca0766677f44920ad3f93b16d216e50c8b943ccdf0da7bb222c8b8

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2036-52-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-86-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-24-0x0000000005330000-0x0000000005396000-memory.dmp

Filesize
408KB

Download
memory/2036-38-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-42-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-88-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-40-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-84-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-82-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-80-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-78-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-36-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-72-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-70-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-68-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-66-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-64-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-62-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-60-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-56-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-44-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-22-0x0000000004CC0000-0x0000000004D26000-memory.dmp

Filesize
408KB

Download
memory/2036-48-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-46-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-54-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-23-0x0000000004D40000-0x00000000052E4000-memory.dmp

Filesize
5.6MB

Download
memory/2036-76-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-34-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-30-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-28-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-74-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-58-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-26-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-50-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-25-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-32-0x0000000005330000-0x000000000538F000-memory.dmp

Filesize
380KB

Download
memory/2036-2105-0x0000000005540000-0x0000000005572000-memory.dmp

Filesize
200KB

Download
memory/3136-2118-0x0000000000240000-0x0000000000270000-memory.dmp

Filesize
192KB

Download
memory/3136-2119-0x0000000002370000-0x0000000002376000-memory.dmp

Filesize
24KB

Download
memory/3136-2120-0x0000000005210000-0x0000000005828000-memory.dmp

Filesize
6.1MB

Download
memory/3136-2121-0x0000000004D00000-0x0000000004E0A000-memory.dmp

Filesize
1.0MB

Download
memory/3136-2122-0x0000000004AB0000-0x0000000004AC2000-memory.dmp

Filesize
72KB

Download
memory/3136-2123-0x0000000004C30000-0x0000000004C6C000-memory.dmp

Filesize
240KB

Download
memory/3136-2124-0x0000000004C70000-0x0000000004CBC000-memory.dmp

Filesize
304KB

Download
memory/3236-2129-0x0000000000E00000-0x0000000000E2E000-memory.dmp

Filesize
184KB

Download
memory/3236-2130-0x0000000002FA0000-0x0000000002FA6000-memory.dmp

Filesize
24KB

Download
memory/4812-14-0x00007FFF59AD3000-0x00007FFF59AD5000-memory.dmp

Filesize
8KB

Download
memory/4812-15-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/4812-16-0x00007FFF59AD3000-0x00007FFF59AD5000-memory.dmp

Filesize
8KB

Download