healer | ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5.exe
Size

706KB
MD5

b629fab1d2dae48bf3cd182652bb97a7
SHA1

9e1abbd17b7a262b3bbfb4e98a1736168b0abd30
SHA256

ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5
SHA512

6f91ea6a49b0c76df32bca581e852805d107156e8f5c5adb5e5681fbfb641c000d281a648e9c7273de915daf370fe5f0d92ed9b6749445c19691b5e1d2e0eba4
SSDEEP

12288:Ty90cjv+mnhVCMiWgYmIxJH8Tygq7DqPfVF9midZaN4IiZtSYzwK:Ty5v+mhVNiWgY5Z8G97sfz9mivaylzwK

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2584-18-0x0000000004980000-0x000000000499A000-memory.dmp	healer
behavioral1/memory/2584-20-0x0000000007710000-0x0000000007728000-memory.dmp	healer
behavioral1/memory/2584-48-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-47-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-44-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-42-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-40-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-38-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-36-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-34-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-32-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-30-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-28-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-26-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-21-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-24-0x0000000007710000-0x0000000007722000-memory.dmp	healer
behavioral1/memory/2584-22-0x0000000007710000-0x0000000007722000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr510114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr510114.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr510114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr510114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr510114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr510114.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/5000-60-0x0000000002F40000-0x0000000002F7C000-memory.dmp	family_redline
behavioral1/memory/5000-61-0x0000000004A50000-0x0000000004A8A000-memory.dmp	family_redline
behavioral1/memory/5000-71-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-75-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-95-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-93-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-91-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-89-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-87-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-85-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-81-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-79-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-77-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-73-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-83-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-69-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-67-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-65-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-63-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/5000-62-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3516	un600633.exe
2584	pr510114.exe
5000	qu916513.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr510114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr510114.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un600633.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	2584	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un600633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr510114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu916513.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2584	pr510114.exe
2584	pr510114.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	pr510114.exe
Token: SeDebugPrivilege	5000	qu916513.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3516	856	ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5.exe	84
PID 856 wrote to memory of 3516	856	ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5.exe	84
PID 856 wrote to memory of 3516	856	ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5.exe	84
PID 3516 wrote to memory of 2584	3516	un600633.exe	85
PID 3516 wrote to memory of 2584	3516	un600633.exe	85
PID 3516 wrote to memory of 2584	3516	un600633.exe	85
PID 3516 wrote to memory of 5000	3516	un600633.exe	96
PID 3516 wrote to memory of 5000	3516	un600633.exe	96
PID 3516 wrote to memory of 5000	3516	un600633.exe	96

C:\Users\Admin\AppData\Local\Temp\ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5.exe
"C:\Users\Admin\AppData\Local\Temp\ee408a509b6358041fe0e675fb988c22d0002fb0b83e13543b8d82a60f561be5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un600633.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un600633.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr510114.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr510114.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1076
      4⤵
      Program crash
      PID:2124
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu916513.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu916513.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2584 -ip 2584
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un600633.exe

Filesize
551KB

MD5
1781d54cedd8b23ef9879336f39e46e3

SHA1
65c7b0064fc4fd698f0ce44f3149f99e6288c717

SHA256
42e0da78244f1f949789b363032122c0a790966e99f195e74513993ed0489318

SHA512
c427136bac5ba76c68596fa1dea3ea86bab88d22c29e1a23a2dd2375cfba106159d49c80f4537264f3095c9f3cdd3bf5234e77a995f0ee01611e1d6f555302ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr510114.exe

Filesize
286KB

MD5
6964c06e173f292ddd293e12eb562f6a

SHA1
e88f12bc1a8634974fa53045e3a87f4bdb97d3f6

SHA256
39defc37a8c7c463ec277ee291475bf8413bc293fcb754eeb7fb926c0565d5cb

SHA512
ee02d22cb5eb44fa89be9d52c0952c961ac07cb13a9ac64da5e101624692b88692c869e5b1ff0d05c4e955d9c0786b60149d4e4b52cf3065ca20aa3f053db5dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu916513.exe

Filesize
368KB

MD5
cb647289fea2b7237bdc6f1cb110dc5f

SHA1
e726cd0023f8edd3b51b4f07fbd1a1f666661f46

SHA256
6242825aa699fe4a4268cd9ac0674fcb53526b3804c0dc358e0f24726b4a4e72

SHA512
d2d5d46b2d8dc94cc69e4517786b53b1dd7a9c68e2416ede5e9d693e9f0260391eba0d78483722c9431c263d84804154a3b60faf39eee9002aca237417351354

Download Submit
memory/2584-15-0x0000000002F10000-0x0000000003010000-memory.dmp

Filesize
1024KB

Download
memory/2584-16-0x0000000002CA0000-0x0000000002CCD000-memory.dmp

Filesize
180KB

Download
memory/2584-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2584-18-0x0000000004980000-0x000000000499A000-memory.dmp

Filesize
104KB

Download
memory/2584-19-0x0000000007110000-0x00000000076B4000-memory.dmp

Filesize
5.6MB

Download
memory/2584-20-0x0000000007710000-0x0000000007728000-memory.dmp

Filesize
96KB

Download
memory/2584-48-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-47-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-44-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-42-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-40-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-38-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-36-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-34-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-32-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-30-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-28-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-26-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-21-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-24-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-22-0x0000000007710000-0x0000000007722000-memory.dmp

Filesize
72KB

Download
memory/2584-49-0x0000000002F10000-0x0000000003010000-memory.dmp

Filesize
1024KB

Download
memory/2584-50-0x0000000002CA0000-0x0000000002CCD000-memory.dmp

Filesize
180KB

Download
memory/2584-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2584-51-0x0000000000400000-0x0000000002BB1000-memory.dmp

Filesize
39.7MB

Download
memory/2584-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2584-54-0x0000000000400000-0x0000000002BB1000-memory.dmp

Filesize
39.7MB

Download
memory/5000-60-0x0000000002F40000-0x0000000002F7C000-memory.dmp

Filesize
240KB

Download
memory/5000-61-0x0000000004A50000-0x0000000004A8A000-memory.dmp

Filesize
232KB

Download
memory/5000-71-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-75-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-95-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-93-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-91-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-89-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-87-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-85-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-81-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-79-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-77-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-73-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-83-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-69-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-67-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-65-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-63-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-62-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/5000-854-0x0000000009CC0000-0x000000000A2D8000-memory.dmp

Filesize
6.1MB

Download
memory/5000-855-0x000000000A350000-0x000000000A362000-memory.dmp

Filesize
72KB

Download
memory/5000-856-0x000000000A370000-0x000000000A47A000-memory.dmp

Filesize
1.0MB

Download
memory/5000-857-0x000000000A490000-0x000000000A4CC000-memory.dmp

Filesize
240KB

Download
memory/5000-858-0x0000000004950000-0x000000000499C000-memory.dmp

Filesize
304KB

Download