healer | 78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00

Resubmissions

29-10-2024 12:29

241029-pn4tdavgqc 10

02-03-2023 17:29

230302-v23q5aea43 10

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29-10-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00.exe
Size

545KB
MD5

799b94c7eb6b0247fd94945a410e2f0a
SHA1

afa3bd9d6cd4cd92b34e20f71e9792e4a34a89d6
SHA256

78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00
SHA512

86cf857e588dee09d0a94ea8ea1a39b3eb9bbb3027cb590fbfa6275b02d1f65d96b30f85287bb09307266e8ffff84b6f253131be0aa6fc4aa24b065bc2087126
SSDEEP

12288:7MrKy90rkXVAU0WTEZERcwUFXsWtAisq9Bv2A:dyDVPgzBTtAwzv2A

Score

10^/10

healer redline stek discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

stek

melevv.eu:4162

Attributes

auth_value
4205381daf6946b2df5fe3bc7eacc918

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002aaf9-12.dat	healer
behavioral4/memory/3144-15-0x0000000000010000-0x000000000001A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sw11Qq09Tb23.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sw11Qq09Tb23.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sw11Qq09Tb23.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sw11Qq09Tb23.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sw11Qq09Tb23.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sw11Qq09Tb23.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral4/memory/3648-22-0x0000000004AA0000-0x0000000004AE6000-memory.dmp	family_redline
behavioral4/memory/3648-24-0x00000000072A0000-0x00000000072E4000-memory.dmp	family_redline
behavioral4/memory/3648-80-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-88-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-86-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-84-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-82-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-78-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-76-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-74-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-72-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-68-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-66-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-64-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-60-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-59-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-56-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-54-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-52-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-48-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-46-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-44-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-42-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-40-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-38-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-36-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-34-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-70-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-32-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-62-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-30-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-28-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-50-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-26-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline
behavioral4/memory/3648-25-0x00000000072A0000-0x00000000072DE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3108	vJk1158PR.exe
3144	sw11Qq09Tb23.exe
3648	tkM57Er72.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	sw11Qq09Tb23.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vJk1158PR.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vJk1158PR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tkM57Er72.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3144	sw11Qq09Tb23.exe
3144	sw11Qq09Tb23.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	sw11Qq09Tb23.exe
Token: SeDebugPrivilege	3648	tkM57Er72.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5348 wrote to memory of 3108	5348	78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00.exe	77
PID 5348 wrote to memory of 3108	5348	78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00.exe	77
PID 5348 wrote to memory of 3108	5348	78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00.exe	77
PID 3108 wrote to memory of 3144	3108	vJk1158PR.exe	78
PID 3108 wrote to memory of 3144	3108	vJk1158PR.exe	78
PID 3108 wrote to memory of 3648	3108	vJk1158PR.exe	79
PID 3108 wrote to memory of 3648	3108	vJk1158PR.exe	79
PID 3108 wrote to memory of 3648	3108	vJk1158PR.exe	79

C:\Users\Admin\AppData\Local\Temp\78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00.exe
"C:\Users\Admin\AppData\Local\Temp\78f2532416cdf8fa1880a04cfa6cdcc475b1a84525b02759dff5550cab182e00.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJk1158PR.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJk1158PR.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw11Qq09Tb23.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw11Qq09Tb23.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkM57Er72.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkM57Er72.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJk1158PR.exe

Filesize
401KB

MD5
3aa20ccc0dce19f7f412160c2eb3af20

SHA1
121b7f4aff0e102f9b8d9d63d36a0a2175eb5e62

SHA256
aefe56a35d5b9a839aa2409eaa5b3be35eefe1ed9cba6ba92db5cb4caf56844f

SHA512
4a5b0e64b03a54d0a52021b58a4c2836f32c0713189bc9d5a7a0e6095bd156fe3ebd7fdf8a2a7ed5baca386fd04900e12469d9e0c7fa23081e34e0444d8b8d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw11Qq09Tb23.exe

Filesize
17KB

MD5
7f8fdbe1239e7ea5d0859ddf3a8e7f81

SHA1
892620725e606396f80c77a62b1de55f8eb3dc0c

SHA256
fcdb7812d3065d46df850ad25064d76c8cb9063a4d52e759bbb40dcbd9d4ba71

SHA512
b20fa8434d12f45282f40200f3069ba6fa50286a0c7ef12f0d1eceff2073383ed1feb687289ffebf8e6cd4d4acaa718f426e3d815965355661f54a2b1317e874

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkM57Er72.exe

Filesize
377KB

MD5
a9bb941524fc5973d45dad1da3e23d17

SHA1
357a2a768bbec255880067c4a774ca2d4bee0588

SHA256
e2e687091711d776f73e3877ee7020f8ed6472855af0db8ee6f5ea796fc34659

SHA512
4beab17e28078481420dfdf5425a6829695cdfdf50c1231c509654bdcaf21d6de21f12ee44b4cbe9c3b555bed3a91542b2dc37b25b2d093e03af9941723d9256

Download Submit
memory/3144-15-0x0000000000010000-0x000000000001A000-memory.dmp

Filesize
40KB

Download
memory/3144-14-0x00007FF982C93000-0x00007FF982C95000-memory.dmp

Filesize
8KB

Download
memory/3144-16-0x00007FF982C93000-0x00007FF982C95000-memory.dmp

Filesize
8KB

Download
memory/3648-935-0x0000000008350000-0x000000000839C000-memory.dmp

Filesize
304KB

Download
memory/3648-59-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-24-0x00000000072A0000-0x00000000072E4000-memory.dmp

Filesize
272KB

Download
memory/3648-80-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-88-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-86-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-84-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-82-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-78-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-76-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-74-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-72-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-68-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-932-0x00000000080A0000-0x00000000081AA000-memory.dmp

Filesize
1.0MB

Download
memory/3648-934-0x0000000008200000-0x000000000823C000-memory.dmp

Filesize
240KB

Download
memory/3648-933-0x00000000081E0000-0x00000000081F2000-memory.dmp

Filesize
72KB

Download
memory/3648-22-0x0000000004AA0000-0x0000000004AE6000-memory.dmp

Filesize
280KB

Download
memory/3648-931-0x0000000007A10000-0x0000000008028000-memory.dmp

Filesize
6.1MB

Download
memory/3648-66-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-64-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-60-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-23-0x0000000007320000-0x00000000078C6000-memory.dmp

Filesize
5.6MB

Download
memory/3648-56-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-54-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-52-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-48-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-46-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-44-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-42-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-40-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-38-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-36-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-34-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-70-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-32-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-62-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-30-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-28-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-50-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-26-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download
memory/3648-25-0x00000000072A0000-0x00000000072DE000-memory.dmp

Filesize
248KB

Download