healer | eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6

Analysis

max time kernel
116s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6.exe
Size

536KB
MD5

5541a5e3c177c8d1b3287ea6b6e1a83d
SHA1

e7ab4768aefa0c0b9227345663368b1c24fc5d09
SHA256

eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6
SHA512

27f23cf66739727e75c92e5372f85a792b955f709e0153dd557c445c4814badb18efa8148142be0cdc602f618ba1624a9383de26708128f8d6d3d42f5bcc330e
SSDEEP

12288:LMrBy90B409nDMj3ghUTb1gsjT9EJZ6mt+pmp5iCRZzl9:mycbHcb/T6JMmYpmBDx9

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b56-12.dat	healer
behavioral1/memory/536-15-0x0000000000DE0000-0x0000000000DEA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr804627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr804627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr804627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr804627.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr804627.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr804627.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/3152-22-0x0000000004A90000-0x0000000004AD6000-memory.dmp	family_redline
behavioral1/memory/3152-24-0x00000000050C0000-0x0000000005104000-memory.dmp	family_redline
behavioral1/memory/3152-46-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-88-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-86-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-85-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-82-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-80-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-78-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-76-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-74-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-70-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-68-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-67-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-64-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-63-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-60-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-59-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-56-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-54-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-52-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-50-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-48-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-44-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-42-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-40-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-38-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-36-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-34-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-32-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-30-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-28-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-72-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-26-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline
behavioral1/memory/3152-25-0x00000000050C0000-0x00000000050FF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4688	zikM1448.exe
536	jr804627.exe
3152	ku808289.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr804627.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zikM1448.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zikM1448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku808289.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
536	jr804627.exe
536	jr804627.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	jr804627.exe
Token: SeDebugPrivilege	3152	ku808289.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 4688	2212	eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6.exe	83
PID 2212 wrote to memory of 4688	2212	eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6.exe	83
PID 2212 wrote to memory of 4688	2212	eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6.exe	83
PID 4688 wrote to memory of 536	4688	zikM1448.exe	84
PID 4688 wrote to memory of 536	4688	zikM1448.exe	84
PID 4688 wrote to memory of 3152	4688	zikM1448.exe	98
PID 4688 wrote to memory of 3152	4688	zikM1448.exe	98
PID 4688 wrote to memory of 3152	4688	zikM1448.exe	98

C:\Users\Admin\AppData\Local\Temp\eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6.exe
"C:\Users\Admin\AppData\Local\Temp\eb40ed67103902d8d3f7d78dd7e4e229754db94e3458041f79dee35f738a1cf6.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikM1448.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikM1448.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr804627.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr804627.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:536
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku808289.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku808289.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikM1448.exe

Filesize
383KB

MD5
342249668af9b587597f553da73ca579

SHA1
b54ada0aafc0cfbeff6b158f35c432e8b234d543

SHA256
291f0ecbf8864769f460b9b05c440a4938f3bc592eda38e6c23282010862a688

SHA512
ebd0150f87e3cb91a188b3d9b182880b4925d9eb7bc7cdccd81b20f16da109c60e3eff2d44b1cb16f0cf3466541d38d889a916575abba379e38513e322f2e7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr804627.exe

Filesize
13KB

MD5
1529cd41fbd2fe2baf228b2184feb2d9

SHA1
e6f78c4bbdf5cfdb0193c5ec4a059c3bd8694d47

SHA256
cba8f398908c7046b7e62e808f982639b5bbdf58f85e96b84d0d09bb691bee53

SHA512
890c5bd2b140f0cb1b2388544fd88f108acd7b69c218eef44f563c0dc2d1c5274dbbb638952f4ef647714622b1349e2d75fd34623a981cf1269fa9ae56269050

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku808289.exe

Filesize
311KB

MD5
2acd83b109ba4a33797a31bf409fd329

SHA1
89760627283cea9e89180ac8fc9bdd60e2c25e95

SHA256
83894f62dcbd94ce6142258e788e620623cbcc89962febf3183f08c213e9ef47

SHA512
39d32a8aec63611c8b25cffcd77d1d72af98c834085534ba783f1f8a2777460385df411f961d9d5a4a6469436a6c0df5d2d422dd0151358533bbd22f9d326b1e

Download Submit
memory/536-14-0x00007FFF4ADB3000-0x00007FFF4ADB5000-memory.dmp

Filesize
8KB

Download
memory/536-15-0x0000000000DE0000-0x0000000000DEA000-memory.dmp

Filesize
40KB

Download
memory/536-16-0x00007FFF4ADB3000-0x00007FFF4ADB5000-memory.dmp

Filesize
8KB

Download
memory/3152-63-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-52-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-24-0x00000000050C0000-0x0000000005104000-memory.dmp

Filesize
272KB

Download
memory/3152-46-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-88-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-86-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-85-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-82-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-80-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-78-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-76-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-74-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-70-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-68-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-67-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-64-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-22-0x0000000004A90000-0x0000000004AD6000-memory.dmp

Filesize
280KB

Download
memory/3152-60-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-59-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-56-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-54-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-23-0x0000000004AD0000-0x0000000005074000-memory.dmp

Filesize
5.6MB

Download
memory/3152-50-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-48-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-44-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-42-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-40-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-38-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-36-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-34-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-32-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-30-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-28-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-72-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-26-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-25-0x00000000050C0000-0x00000000050FF000-memory.dmp

Filesize
252KB

Download
memory/3152-931-0x0000000005100000-0x0000000005718000-memory.dmp

Filesize
6.1MB

Download
memory/3152-932-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/3152-933-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/3152-934-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/3152-935-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download