healer | db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468

Resubmissions

29-10-2024 10:37

241029-mn6xmawjcj 10

05-03-2023 17:28

230305-v187hsgh79 10

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29-10-2024 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468.exe
Size

529KB
MD5

7ea17ce2e57f77f5bf085c72e1459a35
SHA1

752bea1a4b8b14e8f2ea3d3ab6a6e737c210a490
SHA256

db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468
SHA512

2aa4d8e89498b6c6bf306afd7927297faa4ba189b2f65a89616815cdf51da734c0bf36e936d68140fc0549e72dad7af50c78e43c9fed2b97f5e88da20f237d72
SSDEEP

12288:ZMrLy90oHmLzFC0J0MuRWjwJZvRSXGwLrwndwCl5go:uyECou6wJZvRoG6KwCl3

Score

10^/10

healer redline fud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

fud

193.233.20.27:4123

Attributes

auth_value
cddc991efd6918ad5321d80dac884b40

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002aabf-12.dat	healer
behavioral4/memory/2992-15-0x0000000000390000-0x000000000039A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sf76Bk98wk38.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sf76Bk98wk38.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sf76Bk98wk38.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sf76Bk98wk38.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sf76Bk98wk38.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sf76Bk98wk38.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral4/memory/1784-25-0x0000000004CE0000-0x0000000004D26000-memory.dmp	family_redline
behavioral4/memory/1784-27-0x0000000005320000-0x0000000005364000-memory.dmp	family_redline
behavioral4/memory/1784-28-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-41-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-39-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-91-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-89-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-87-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-85-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-83-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-81-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-79-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-75-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-73-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-72-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-70-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-67-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-65-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-64-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-61-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-59-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-57-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-55-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-53-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-51-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-49-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-45-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-43-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-37-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-35-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-33-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-77-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-31-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-47-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline
behavioral4/memory/1784-29-0x0000000005320000-0x000000000535E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
748	vhda6412ZQ.exe
2992	sf76Bk98wk38.exe
1784	tf55Ni81Pf68.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	sf76Bk98wk38.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vhda6412ZQ.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vhda6412ZQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tf55Ni81Pf68.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	sf76Bk98wk38.exe
2992	sf76Bk98wk38.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	sf76Bk98wk38.exe
Token: SeDebugPrivilege	1784	tf55Ni81Pf68.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 748	2924	db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468.exe	80
PID 2924 wrote to memory of 748	2924	db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468.exe	80
PID 2924 wrote to memory of 748	2924	db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468.exe	80
PID 748 wrote to memory of 2992	748	vhda6412ZQ.exe	81
PID 748 wrote to memory of 2992	748	vhda6412ZQ.exe	81
PID 748 wrote to memory of 1784	748	vhda6412ZQ.exe	84
PID 748 wrote to memory of 1784	748	vhda6412ZQ.exe	84
PID 748 wrote to memory of 1784	748	vhda6412ZQ.exe	84

C:\Users\Admin\AppData\Local\Temp\db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468.exe
"C:\Users\Admin\AppData\Local\Temp\db89c00ee892015b59cd0e96504940d720a3c218c4670f09c24a70bc0025a468.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhda6412ZQ.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhda6412ZQ.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf76Bk98wk38.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf76Bk98wk38.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf55Ni81Pf68.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf55Ni81Pf68.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhda6412ZQ.exe

Filesize
385KB

MD5
e1e184ad47c64021cfd35abc4af766f4

SHA1
4906ad7d6b7388ef759a2363152627410b420c21

SHA256
0aba26326c04ce917e36869973bfabe38c7125ba69755afd9f13951f87e853e9

SHA512
5840bb91368be94cf1c6af9c17950ef45f3a03c8522a6be99867dbb9aebbd7d8a48217de026402238a7c28caa6651702f41634c6a93b0b1fcb33c8460d126336

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf76Bk98wk38.exe

Filesize
11KB

MD5
14a78ce221fe8260ea11839b96260d7a

SHA1
170b71519031db5813d26c050c08e228d0993971

SHA256
bff201e862ffe1aab4b8349062bdf7a4fb094588b458de08a4239351d8c910c4

SHA512
f66db240612684a84fc0c5a487b0fb87218e40066d39a1a4b9ea0390ee251522b2061d1b17bfbef944f1d352f3d78b68d75eff0c09f11039c2f45084b35656b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf55Ni81Pf68.exe

Filesize
292KB

MD5
01f55e38d4139a3f84f11a36dbb67824

SHA1
28ba3e42c1bd4a60732f8a2b34771aa026253000

SHA256
2dcc02ccacc4b825f2b5d18d6139650cad2798618e2fd66cac757735a3824004

SHA512
56a9d5e32131b4d7265d3d0f7b049132400d58731717c3437b756b3597743637dce907a9932d4e82cc039e22c747380fe19c560df3dd6d8b0c7a98502a862de0

Download Submit
memory/1784-23-0x0000000000770000-0x00000000007BB000-memory.dmp

Filesize
300KB

Download
memory/1784-22-0x0000000000870000-0x0000000000970000-memory.dmp

Filesize
1024KB

Download
memory/1784-24-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1784-25-0x0000000004CE0000-0x0000000004D26000-memory.dmp

Filesize
280KB

Download
memory/1784-26-0x0000000004D20000-0x00000000052C6000-memory.dmp

Filesize
5.6MB

Download
memory/1784-27-0x0000000005320000-0x0000000005364000-memory.dmp

Filesize
272KB

Download
memory/1784-28-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-41-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-39-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-91-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-89-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-87-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-85-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-83-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-81-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-79-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-75-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-73-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-72-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-70-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-67-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-65-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-64-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-61-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-59-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-57-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-55-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-53-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-51-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-49-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-45-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-43-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-37-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-35-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-33-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-77-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-31-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-47-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-29-0x0000000005320000-0x000000000535E000-memory.dmp

Filesize
248KB

Download
memory/1784-934-0x00000000053C0000-0x00000000059D8000-memory.dmp

Filesize
6.1MB

Download
memory/1784-935-0x0000000005A60000-0x0000000005B6A000-memory.dmp

Filesize
1.0MB

Download
memory/1784-936-0x0000000005BA0000-0x0000000005BB2000-memory.dmp

Filesize
72KB

Download
memory/1784-937-0x0000000005BC0000-0x0000000005BFC000-memory.dmp

Filesize
240KB

Download
memory/1784-938-0x0000000005D10000-0x0000000005D5C000-memory.dmp

Filesize
304KB

Download
memory/1784-939-0x0000000000870000-0x0000000000970000-memory.dmp

Filesize
1024KB

Download
memory/1784-940-0x0000000000770000-0x00000000007BB000-memory.dmp

Filesize
300KB

Download
memory/1784-942-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2992-14-0x00007FFF856F3000-0x00007FFF856F5000-memory.dmp

Filesize
8KB

Download
memory/2992-15-0x0000000000390000-0x000000000039A000-memory.dmp

Filesize
40KB

Download
memory/2992-16-0x00007FFF856F3000-0x00007FFF856F5000-memory.dmp

Filesize
8KB

Download