healer | 9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6.exe
Size

1.0MB
MD5

8f0f2514c6bbc888a2cfb02ca90ee34f
SHA1

2320b57aea813c026a8a14c8e762d2a6c41913de
SHA256

9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6
SHA512

ead058b129c734242e1d245392251078b97fc705b739f66614a6563ee9afbdb5fd07cdd7e713fcc38816f7223f8f7f09f06b222d3bd1ff3946cc5c998d02e045
SSDEEP

24576:wyzxt/KuvaoqhlOrnYvnewT+KaxKQRry1lUfeUgd5UNGm/ns:3zf/XioECynirryvI3NGK

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1468-23-0x00000000025B0000-0x00000000025CA000-memory.dmp	healer
behavioral1/memory/1468-25-0x0000000002710000-0x0000000002728000-memory.dmp	healer
behavioral1/memory/1468-29-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-53-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-51-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-49-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-47-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-45-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-43-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-41-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-39-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-37-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-35-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-34-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-32-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-26-0x0000000002710000-0x0000000002722000-memory.dmp	healer
behavioral1/memory/1468-27-0x0000000002710000-0x0000000002722000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr458004.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr458004.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr458004.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr458004.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr458004.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr458004.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4736-62-0x00000000027A0000-0x00000000027DC000-memory.dmp	family_redline
behavioral1/memory/4736-63-0x00000000029A0000-0x00000000029DA000-memory.dmp	family_redline
behavioral1/memory/4736-87-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-97-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-95-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-93-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-91-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-89-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-85-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-81-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-77-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-83-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-80-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-76-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-73-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-71-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-69-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-67-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-65-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline
behavioral1/memory/4736-64-0x00000000029A0000-0x00000000029D5000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4180	un121647.exe
4868	un146283.exe
1468	pr458004.exe
4736	qu733179.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr458004.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr458004.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un121647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un146283.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4408	1468	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu733179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un121647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un146283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr458004.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	pr458004.exe
1468	pr458004.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	pr458004.exe
Token: SeDebugPrivilege	4736	qu733179.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4180	4780	9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6.exe	84
PID 4780 wrote to memory of 4180	4780	9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6.exe	84
PID 4780 wrote to memory of 4180	4780	9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6.exe	84
PID 4180 wrote to memory of 4868	4180	un121647.exe	85
PID 4180 wrote to memory of 4868	4180	un121647.exe	85
PID 4180 wrote to memory of 4868	4180	un121647.exe	85
PID 4868 wrote to memory of 1468	4868	un146283.exe	87
PID 4868 wrote to memory of 1468	4868	un146283.exe	87
PID 4868 wrote to memory of 1468	4868	un146283.exe	87
PID 4868 wrote to memory of 4736	4868	un146283.exe	93
PID 4868 wrote to memory of 4736	4868	un146283.exe	93
PID 4868 wrote to memory of 4736	4868	un146283.exe	93

C:\Users\Admin\AppData\Local\Temp\9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6.exe
"C:\Users\Admin\AppData\Local\Temp\9e6e757d18cb8cd53f3c892d6ebeecaff8d80b65bc3d1310ce149b64a32b8bd6.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121647.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121647.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un146283.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un146283.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr458004.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr458004.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1080
        5⤵
        Program crash
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu733179.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu733179.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1468 -ip 1468
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un121647.exe

Filesize
750KB

MD5
35882646cf522bca0b7a91ab1df194ba

SHA1
571463f938891eabfb6494688f646709fd23c635

SHA256
cf454085daa452aeb2ee5db483f2d6cad5ea901ac8ac5bc1f5bebdec846cb151

SHA512
d274676e5e0c2a60d032a06271879095e92b2caebd8ee77d9e241a49c4e823ecc20e6509e5ef0579eb30f370e48cefe6ec2f8f4978e97ec9298082c3b7afe12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un146283.exe

Filesize
596KB

MD5
1555ce9883675d2e21742dcd65213f6f

SHA1
3bb87d535ada6c5db701c57ebef648a984382650

SHA256
c30695da8b8c56a1ca0896ac9690218ce2b479ff9e500a7ab8938b5120c77675

SHA512
973bcaa7d791fea94af609a7de3e5946ae4892802441706509319ac4a1e4fee65b2e253ad7828694ef7cea582ed17e093228c26c59a44c2c4d7e7cefa789fa5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr458004.exe

Filesize
389KB

MD5
4231e6c0db5c83f39fc069dc782f9954

SHA1
9f70caf4af4aa21a6304da214aef664a63ce3566

SHA256
935392c04dfb4b7744266142cc1f0ced862886bdddc006e3994a41d49178e8a6

SHA512
fb90ec5701709a3bafc85c8d7aa34553f0e975969585e67ae9d74e046bf4a8fd1b37c2c95e4a22230e54c3fdef446dc8fb099639fac724ae2558ac0c60af332b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu733179.exe

Filesize
472KB

MD5
4e5625387b0222574e5587fb86931640

SHA1
4e5fef7d5cbb27824fbafa9344abb9bff88250d7

SHA256
f44074df278a222914b4414bad5db58df1c683ff2e0bbeaf15c37795d18b3f11

SHA512
ecdc54bc090979cb00e9773c00e3faadebe2cb420055ddec1332dbcf857c334f6b4d7087fee7820859f4e6805d399552157dc5e8cd68ad742dd72ad3692a6fc1

Download Submit
memory/1468-54-0x0000000000400000-0x0000000000806000-memory.dmp

Filesize
4.0MB

Download
memory/1468-24-0x0000000004F40000-0x00000000054E4000-memory.dmp

Filesize
5.6MB

Download
memory/1468-25-0x0000000002710000-0x0000000002728000-memory.dmp

Filesize
96KB

Download
memory/1468-29-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-53-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-51-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-49-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-47-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-45-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-43-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-41-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-39-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-37-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-35-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-34-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-32-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-26-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-27-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/1468-55-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/1468-23-0x00000000025B0000-0x00000000025CA000-memory.dmp

Filesize
104KB

Download
memory/1468-57-0x0000000000400000-0x0000000000806000-memory.dmp

Filesize
4.0MB

Download
memory/1468-22-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/4736-64-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-76-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-93-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-97-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-95-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-87-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-91-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-89-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-85-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-81-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-77-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-83-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-80-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-859-0x00000000081D0000-0x000000000820C000-memory.dmp

Filesize
240KB

Download
memory/4736-73-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-71-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-69-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-67-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-65-0x00000000029A0000-0x00000000029D5000-memory.dmp

Filesize
212KB

Download
memory/4736-63-0x00000000029A0000-0x00000000029DA000-memory.dmp

Filesize
232KB

Download
memory/4736-856-0x0000000007A00000-0x0000000008018000-memory.dmp

Filesize
6.1MB

Download
memory/4736-857-0x0000000008090000-0x00000000080A2000-memory.dmp

Filesize
72KB

Download
memory/4736-858-0x00000000080B0000-0x00000000081BA000-memory.dmp

Filesize
1.0MB

Download
memory/4736-62-0x00000000027A0000-0x00000000027DC000-memory.dmp

Filesize
240KB

Download
memory/4736-860-0x00000000026B0000-0x00000000026FC000-memory.dmp

Filesize
304KB

Download