healer | 3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe
Size

506KB
MD5

fa0fd6adbe3144f7be3b80abd9d89200
SHA1

975744462109941b84ed2685fcb361bd74cb0452
SHA256

3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1
SHA512

d06930b3a12fbccfac9f033a6aabc1e066ace368dcdf549e041b2fb26f2a9a94ae40a7bd950bd23804f0641cb9e4c38675e59bcd119119a09baebe2f2a1bca88
SSDEEP

12288:GMrDy90cFY+nb+54USBX95cOp1IPbTZzh8f5X:Nyf5+54USBtSbTXu5X

Score

10^/10

healer redline norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000c000000023b88-5.dat	healer
behavioral1/memory/5064-8-0x00000000005B0000-0x00000000005BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr028976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr028976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr028976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr028976.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr028976.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr028976.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/4972-2101-0x0000000005540000-0x0000000005572000-memory.dmp	family_redline
behavioral1/files/0x000b000000023b89-2106.dat	family_redline
behavioral1/memory/3024-2114-0x0000000000800000-0x0000000000830000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	ku727654.exe

Executes dropped EXE 3 IoCs

pid	Process
5064	jr028976.exe
4972	ku727654.exe
3024	1.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr028976.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3552	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	4972	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku727654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5064	jr028976.exe
5064	jr028976.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	jr028976.exe
Token: SeDebugPrivilege	4972	ku727654.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 5064	1508	3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe	83
PID 1508 wrote to memory of 5064	1508	3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe	83
PID 1508 wrote to memory of 4972	1508	3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe	92
PID 1508 wrote to memory of 4972	1508	3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe	92
PID 1508 wrote to memory of 4972	1508	3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe	92
PID 4972 wrote to memory of 3024	4972	ku727654.exe	93
PID 4972 wrote to memory of 3024	4972	ku727654.exe	93
PID 4972 wrote to memory of 3024	4972	ku727654.exe	93

C:\Users\Admin\AppData\Local\Temp\3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe
"C:\Users\Admin\AppData\Local\Temp\3defa661d44705785ab5ecb1bee164183ee32f8b3b34886e103e02e7d622d0a1.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr028976.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr028976.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku727654.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku727654.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\Temp\1.exe
    "C:\Windows\Temp\1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1384
    3⤵
    - Program crash
    PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4972 -ip 4972
1⤵
PID:4372

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr028976.exe

Filesize
14KB

MD5
a556d018ba77727a611e2403ee66be49

SHA1
03d3a3cfa56baeced1108e92be0f363dac06e152

SHA256
1850ab828f5f6097a66d047577e4590d158f313d834ea8652bddd6a12745ff21

SHA512
5f455b1166456c83ea35a37874790a4ca0f9c5c996594b6ad70ef1748744c9ab471e2c1e2d5ddc302ee2f36bd2697946ee1e70f610b5641dc1280e36d15afa7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku727654.exe

Filesize
426KB

MD5
0e9c6cf9f1a58ef08e65e6f651df82a4

SHA1
7ba3654a7b71e3463458209f125612b59d59d4f0

SHA256
4c4a00e4bfa2d4eab4e8cc9077cb2fe02d3cdc199f2a86b7a4c3bf6c6c43b978

SHA512
338409029978d8b2fe3aa553d1ac6625c40c3b7e460ba5ebd5a3f0c53160f21203e36b5d84047c2311afbf7360207f5ae560bb9687277e9df76cf5769b61eb8f

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/3024-2114-0x0000000000800000-0x0000000000830000-memory.dmp

Filesize
192KB

Download
memory/3024-2120-0x0000000005230000-0x000000000527C000-memory.dmp

Filesize
304KB

Download
memory/3024-2119-0x00000000051F0000-0x000000000522C000-memory.dmp

Filesize
240KB

Download
memory/3024-2118-0x0000000005190000-0x00000000051A2000-memory.dmp

Filesize
72KB

Download
memory/3024-2117-0x0000000005280000-0x000000000538A000-memory.dmp

Filesize
1.0MB

Download
memory/3024-2116-0x0000000005790000-0x0000000005DA8000-memory.dmp

Filesize
6.1MB

Download
memory/3024-2115-0x00000000029B0000-0x00000000029B6000-memory.dmp

Filesize
24KB

Download
memory/4972-52-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-34-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-84-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-82-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-80-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-76-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-74-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-72-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-68-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-66-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-64-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-62-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-60-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-58-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-56-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-54-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-42-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-50-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-48-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-44-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-40-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-38-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-37-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-46-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-32-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-30-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-28-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-26-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-78-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-70-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-24-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-22-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-20-0x0000000004D40000-0x0000000004DA6000-memory.dmp

Filesize
408KB

Download
memory/4972-19-0x0000000004DC0000-0x0000000005364000-memory.dmp

Filesize
5.6MB

Download
memory/4972-18-0x0000000004CD0000-0x0000000004D36000-memory.dmp

Filesize
408KB

Download
memory/4972-17-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4972-16-0x00000000005B0000-0x000000000060B000-memory.dmp

Filesize
364KB

Download
memory/4972-15-0x00000000007C0000-0x00000000008C0000-memory.dmp

Filesize
1024KB

Download
memory/4972-21-0x0000000004D40000-0x0000000004D9F000-memory.dmp

Filesize
380KB

Download
memory/4972-2101-0x0000000005540000-0x0000000005572000-memory.dmp

Filesize
200KB

Download
memory/4972-2122-0x00000000005B0000-0x000000000060B000-memory.dmp

Filesize
364KB

Download
memory/4972-2123-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/5064-7-0x00007FFA49013000-0x00007FFA49015000-memory.dmp

Filesize
8KB

Download
memory/5064-8-0x00000000005B0000-0x00000000005BA000-memory.dmp

Filesize
40KB

Download
memory/5064-9-0x00007FFA49013000-0x00007FFA49015000-memory.dmp

Filesize
8KB

Download