healer | b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594.exe
Size

1.1MB
MD5

998eccf26e123335a9d00699aae4c43a
SHA1

274edeac2d797412876ad2e9676234bba3853a67
SHA256

b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594
SHA512

cbaab87905881fda6f7dcc408d1be7988f4444117fc8d65b1eef428d4ece64adf3a9c2251da8de0ab59b8b5bb3c85ae440f3bc098ba3edecf82733f8f6b359ef
SSDEEP

24576:Cy/CNPxgPMcewjwjJ1lyzNTnqrl7Wl5iJ7KHxjePNEB3En:pyxgRsjJCTnqrl7Wy7KHxOe3E

Score

10^/10

healer redline ronam discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

ronam

193.233.20.17:4139

Attributes

auth_value
125421d19d14dd7fd211bc7f6d4aea6c

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/380-29-0x00000000024C0000-0x00000000024DA000-memory.dmp	healer
behavioral1/memory/380-31-0x00000000026C0000-0x00000000026D8000-memory.dmp	healer
behavioral1/memory/380-55-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-59-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-57-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-53-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-51-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-49-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-47-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-45-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-43-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-41-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-39-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-37-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-35-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-33-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer
behavioral1/memory/380-32-0x00000000026C0000-0x00000000026D2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	anF62TZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	anF62TZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	anF62TZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	anF62TZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	anF62TZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	anF62TZ.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3064-67-0x0000000002570000-0x00000000025B6000-memory.dmp	family_redline
behavioral1/memory/3064-68-0x00000000027D0000-0x0000000002814000-memory.dmp	family_redline
behavioral1/memory/3064-74-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-80-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-102-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-101-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-98-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-96-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-94-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-92-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-90-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-88-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-86-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-84-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-82-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-78-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-76-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-72-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-70-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline
behavioral1/memory/3064-69-0x00000000027D0000-0x000000000280E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
4484	nCo94Yc.exe
2180	nzk56an.exe
4148	nHc53fQ.exe
380	anF62TZ.exe
3064	bUS32nT.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	anF62TZ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	anF62TZ.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nzk56an.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	nHc53fQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nCo94Yc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	380	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nCo94Yc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nzk56an.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nHc53fQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anF62TZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bUS32nT.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
380	anF62TZ.exe
380	anF62TZ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	anF62TZ.exe
Token: SeDebugPrivilege	3064	bUS32nT.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4484	3332	b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594.exe	84
PID 3332 wrote to memory of 4484	3332	b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594.exe	84
PID 3332 wrote to memory of 4484	3332	b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594.exe	84
PID 4484 wrote to memory of 2180	4484	nCo94Yc.exe	85
PID 4484 wrote to memory of 2180	4484	nCo94Yc.exe	85
PID 4484 wrote to memory of 2180	4484	nCo94Yc.exe	85
PID 2180 wrote to memory of 4148	2180	nzk56an.exe	87
PID 2180 wrote to memory of 4148	2180	nzk56an.exe	87
PID 2180 wrote to memory of 4148	2180	nzk56an.exe	87
PID 4148 wrote to memory of 380	4148	nHc53fQ.exe	88
PID 4148 wrote to memory of 380	4148	nHc53fQ.exe	88
PID 4148 wrote to memory of 380	4148	nHc53fQ.exe	88
PID 4148 wrote to memory of 3064	4148	nHc53fQ.exe	98
PID 4148 wrote to memory of 3064	4148	nHc53fQ.exe	98
PID 4148 wrote to memory of 3064	4148	nHc53fQ.exe	98

C:\Users\Admin\AppData\Local\Temp\b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594.exe
"C:\Users\Admin\AppData\Local\Temp\b13337f962e439aa83e82d0b7e1310bbe34bdefc372f48b25e23ab8256e16594.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nCo94Yc.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nCo94Yc.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nzk56an.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nzk56an.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nHc53fQ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nHc53fQ.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\anF62TZ.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\anF62TZ.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 1080
        6⤵
        Program crash
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bUS32nT.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bUS32nT.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 380 -ip 380
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nCo94Yc.exe

Filesize
915KB

MD5
24638df6d2b9b31795a3d3711d75513b

SHA1
97d46397340cbb1346c3815719cb3c5a8a7b9fdf

SHA256
3e6f211608f3491401d8432bb5e3b6ffd5bc3f7ccf18bbd154ada8a01ad7bd47

SHA512
597b3fa0fd966ded1b2ce1f62c73853da5999f3056fed8f1bad554d80b86ac6a492a409559c0e5358f5351efdd65a6e439519762937af604123cad5e304eab2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nzk56an.exe

Filesize
690KB

MD5
523a6bd1db93bb85ae62a08498f4cd52

SHA1
685b7ef95dcc989a98bc394772f327631fb9cbd5

SHA256
aa541b897d4bd36622d90df4327ac501c1d5163e98b953a360f22ead011e0958

SHA512
59dc46f77dd4fa0c041c439068e66913a4974f3e27ea7cfe7e24f3c67aa27725ee6e15b58a282c1e45cecb2f5da12f6965f23f18a9af0e380b4a0ee908b6cf3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nHc53fQ.exe

Filesize
545KB

MD5
2adddcb62f02f5e0b31fa0caeffa2e5a

SHA1
53014ce6a1ac342dbbaafd6af7aa11df45d9698d

SHA256
287ce83e445cca76a5f3fc7efc091462abbb0124414b5d225ec206bddd4f485b

SHA512
c044c00b79a2cc88e241f4309a66803f600596713624d817a63772fadef49050c6490c460c229c7ccb37190aaadda9cfa10f52134da8656543c5e3c05ee1b29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\anF62TZ.exe

Filesize
268KB

MD5
e91c24b9a5ee16932fc8e9531db83922

SHA1
5b5486a401d45f458943a6b205aeb957c6e91899

SHA256
a56c5afa0cab7e72d0c2759f388252e442cedac285d53356167e6b85b43f4bdb

SHA512
afb49002fe8ee4350c2bda9e3acc12625d96fd47f5874b8c79286543962cdcfaed174ef1356c13ba54f68441a1507c2c8342570a9db883cabd3035828133cb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bUS32nT.exe

Filesize
329KB

MD5
f8a8a9163c847a2144670680479a771f

SHA1
e0f0cde7f67b18eb48bb253171508b1b3e39c172

SHA256
def50e848f25c94a89584f91d99c89791531b1371baf1e6c5f74e9c4e81df673

SHA512
1ebe59ce59652bc34e25ea90f1fce93a5fda9924c716712873840c5996cc535f6db212606cba74b2dc59c42a8ccfcb47d9d001bbfad4b9213552d8e502dfff35

Download Submit
memory/380-62-0x0000000000400000-0x0000000000574000-memory.dmp

Filesize
1.5MB

Download
memory/380-59-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-55-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-60-0x0000000000400000-0x0000000000574000-memory.dmp

Filesize
1.5MB

Download
memory/380-57-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-53-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-51-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-49-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-47-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-45-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-43-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-41-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-39-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-37-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-35-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-33-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-32-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/380-31-0x00000000026C0000-0x00000000026D8000-memory.dmp

Filesize
96KB

Download
memory/380-30-0x0000000004E80000-0x0000000005424000-memory.dmp

Filesize
5.6MB

Download
memory/380-29-0x00000000024C0000-0x00000000024DA000-memory.dmp

Filesize
104KB

Download
memory/3064-978-0x0000000005A70000-0x0000000005AAC000-memory.dmp

Filesize
240KB

Download
memory/3064-84-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-67-0x0000000002570000-0x00000000025B6000-memory.dmp

Filesize
280KB

Download
memory/3064-102-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-74-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-101-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-98-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-96-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-94-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-92-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-90-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-88-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-86-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-68-0x00000000027D0000-0x0000000002814000-memory.dmp

Filesize
272KB

Download
memory/3064-82-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-78-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-76-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-72-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-70-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-69-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-975-0x0000000005280000-0x0000000005898000-memory.dmp

Filesize
6.1MB

Download
memory/3064-976-0x0000000005910000-0x0000000005A1A000-memory.dmp

Filesize
1.0MB

Download
memory/3064-977-0x0000000005A50000-0x0000000005A62000-memory.dmp

Filesize
72KB

Download
memory/3064-80-0x00000000027D0000-0x000000000280E000-memory.dmp

Filesize
248KB

Download
memory/3064-979-0x0000000005C00000-0x0000000005C4C000-memory.dmp

Filesize
304KB

Download