healer | 2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80.exe
Size

681KB
MD5

118b0ed8848e8d16cdd8912637db9b4d
SHA1

cddbfc2057e29b70613bc8d530fc8c8e5545fc5c
SHA256

2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80
SHA512

563881740d11acc28260713ffcc14022d87fd9be8e6404b1d9b0b3da32c04afb630ad0aebb9e903d607a839cd529677f2fd9af0f48886d839af3678b6eacd9d8
SSDEEP

12288:uMrfy90xj2QRguvLajeqwwh0qzs9kGO6MifVQdizb:hy2jJguv2jeq90qzQ9Mifii

Score

10^/10

healer redline stek discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

stek

melevv.eu:4162

Attributes

auth_value
4205381daf6946b2df5fe3bc7eacc918

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3776-19-0x0000000002190000-0x00000000021AA000-memory.dmp	healer
behavioral1/memory/3776-21-0x0000000004BD0000-0x0000000004BE8000-memory.dmp	healer
behavioral1/memory/3776-27-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-47-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-45-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-43-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-41-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-39-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-37-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-35-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-33-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-31-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-30-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-25-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-23-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-22-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer
behavioral1/memory/3776-49-0x0000000004BD0000-0x0000000004BE2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	urkn67CI01.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	urkn67CI01.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	urkn67CI01.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	urkn67CI01.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	urkn67CI01.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	urkn67CI01.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3624-61-0x0000000002350000-0x0000000002396000-memory.dmp	family_redline
behavioral1/memory/3624-62-0x0000000004C00000-0x0000000004C44000-memory.dmp	family_redline
behavioral1/memory/3624-64-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-80-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-97-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-94-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-92-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-90-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-88-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-86-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-84-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-82-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-78-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-76-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-74-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-72-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-70-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-68-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-66-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline
behavioral1/memory/3624-63-0x0000000004C00000-0x0000000004C3E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2240	ycrZ84lq78.exe
3776	urkn67CI01.exe
3624	wrKS23Dc05.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	urkn67CI01.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	urkn67CI01.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ycrZ84lq78.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3224	3776	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ycrZ84lq78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urkn67CI01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrKS23Dc05.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3776	urkn67CI01.exe
3776	urkn67CI01.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3776	urkn67CI01.exe
Token: SeDebugPrivilege	3624	wrKS23Dc05.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2240	2600	2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80.exe	85
PID 2600 wrote to memory of 2240	2600	2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80.exe	85
PID 2600 wrote to memory of 2240	2600	2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80.exe	85
PID 2240 wrote to memory of 3776	2240	ycrZ84lq78.exe	86
PID 2240 wrote to memory of 3776	2240	ycrZ84lq78.exe	86
PID 2240 wrote to memory of 3776	2240	ycrZ84lq78.exe	86
PID 2240 wrote to memory of 3624	2240	ycrZ84lq78.exe	92
PID 2240 wrote to memory of 3624	2240	ycrZ84lq78.exe	92
PID 2240 wrote to memory of 3624	2240	ycrZ84lq78.exe	92

C:\Users\Admin\AppData\Local\Temp\2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80.exe
"C:\Users\Admin\AppData\Local\Temp\2692ad234e731f35fe48031ef28e50bb34f63c62f707ef17ef5be38d5ec94c80.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycrZ84lq78.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycrZ84lq78.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urkn67CI01.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urkn67CI01.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 1084
      4⤵
      Program crash
      PID:3224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrKS23Dc05.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrKS23Dc05.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3776 -ip 3776
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycrZ84lq78.exe

Filesize
536KB

MD5
ff8a701b0cc26e8a712dd88cba107cdc

SHA1
eb875a2e8a4d5262a4826bb961e8fc33e6f0323e

SHA256
ae66b2500674096e4114c05761ce3f651222c150f68cf6c1da13713d57b44fb0

SHA512
fe598819562c6da090981d9361970e4a477d8d67b7a17a48ccd5a08b390bc54e9c6759a1d0b7e8a5fa2c0e696ef0262989546255638cc8931e555c8939b88c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urkn67CI01.exe

Filesize
250KB

MD5
595e27da5ff52d153d2eb5e0c4834bd7

SHA1
d0952d8d39baae6bf90ce179a2879cfc6fcb340b

SHA256
dda87c27a7b7609286c35fc111c40d699eca19485e24c9cf4f710565bb94a720

SHA512
417bd633a8aeb9d2c784a847fb4a5367b7626053bc1dde1da63ac42d86137fd4c0dfb73dae5b57f88856160120fb848723ff3be92b23349b81c834ba0a98f5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrKS23Dc05.exe

Filesize
308KB

MD5
9deb98e21d80840ff993f7170b1340c6

SHA1
c079fb7d92f9c5937beabfb214e395d44857b547

SHA256
0e322b46c3f8f35ba9c4ee94971e715a813122f2ada84754e3da7789f995e2cc

SHA512
f975d294bccd1627c3845fe3ce49f94244805d3c06abac0a390c0d4263de71d89d14502bd97a6ba7a848bacc4571f18d879bf02f70044e312732a8548d0acaf4

Download Submit
memory/3624-76-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-82-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-970-0x00000000059A0000-0x0000000005AAA000-memory.dmp

Filesize
1.0MB

Download
memory/3624-969-0x0000000005380000-0x0000000005998000-memory.dmp

Filesize
6.1MB

Download
memory/3624-63-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-66-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-68-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-70-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-72-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-74-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-972-0x0000000004D70000-0x0000000004DAC000-memory.dmp

Filesize
240KB

Download
memory/3624-973-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

Filesize
304KB

Download
memory/3624-78-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-971-0x0000000004D50000-0x0000000004D62000-memory.dmp

Filesize
72KB

Download
memory/3624-84-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-86-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-88-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-90-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-92-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-94-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-97-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-80-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-64-0x0000000004C00000-0x0000000004C3E000-memory.dmp

Filesize
248KB

Download
memory/3624-62-0x0000000004C00000-0x0000000004C44000-memory.dmp

Filesize
272KB

Download
memory/3624-61-0x0000000002350000-0x0000000002396000-memory.dmp

Filesize
280KB

Download
memory/3776-41-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-55-0x0000000000400000-0x0000000000621000-memory.dmp

Filesize
2.1MB

Download
memory/3776-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3776-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3776-51-0x0000000000630000-0x000000000065D000-memory.dmp

Filesize
180KB

Download
memory/3776-50-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/3776-49-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-22-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-23-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-25-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-30-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-31-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-33-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-35-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-37-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-39-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-43-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-45-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-47-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-27-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/3776-21-0x0000000004BD0000-0x0000000004BE8000-memory.dmp

Filesize
96KB

Download
memory/3776-20-0x0000000004CB0000-0x0000000005254000-memory.dmp

Filesize
5.6MB

Download
memory/3776-19-0x0000000002190000-0x00000000021AA000-memory.dmp

Filesize
104KB

Download
memory/3776-18-0x0000000000400000-0x0000000000621000-memory.dmp

Filesize
2.1MB

Download
memory/3776-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3776-16-0x0000000000630000-0x000000000065D000-memory.dmp

Filesize
180KB

Download
memory/3776-15-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download