healer | 301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686.exe
Size

560KB
MD5

3993aa691659d72099814d6d8f4b2a32
SHA1

b66d9c2359b92b3cb33520d0bfba4f7988d4f018
SHA256

301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686
SHA512

10acd16cf86e89e006ec3b3dcc0577ee023f9e403973d02a9d3203d59d4a099f3cd6615fd07ca72ae865164460343ee1a21e02178bd71fcc57c9ed6ddf0c321e
SSDEEP

12288:bMrey90kEvqVI7+s8aGhGDK83qyy0JGB88WCfchTOuntCFA2h:5yiSVqTtb3qyfc5WCkROuntsh

Score

10^/10

healer redline fud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

fud

193.233.20.27:4123

Attributes

auth_value
cddc991efd6918ad5321d80dac884b40

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cb7-12.dat	healer
behavioral1/memory/2424-15-0x0000000000760000-0x000000000076A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sf69Uh62LF97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sf69Uh62LF97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sf69Uh62LF97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sf69Uh62LF97.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sf69Uh62LF97.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sf69Uh62LF97.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/4796-22-0x0000000004E40000-0x0000000004E86000-memory.dmp	family_redline
behavioral1/memory/4796-24-0x0000000004EC0000-0x0000000004F04000-memory.dmp	family_redline
behavioral1/memory/4796-58-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-74-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-88-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-86-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-84-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-82-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-80-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-78-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-76-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-72-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-70-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-68-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-66-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-64-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-62-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-60-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-56-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-54-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-52-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-50-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-48-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-46-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-44-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-42-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-40-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-36-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-34-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-32-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-30-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-28-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-38-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-26-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline
behavioral1/memory/4796-25-0x0000000004EC0000-0x0000000004EFE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3108	vhst6994VG.exe
2424	sf69Uh62LF97.exe
4796	tf69Au82nf21.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	sf69Uh62LF97.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vhst6994VG.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vhst6994VG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tf69Au82nf21.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2424	sf69Uh62LF97.exe
2424	sf69Uh62LF97.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	sf69Uh62LF97.exe
Token: SeDebugPrivilege	4796	tf69Au82nf21.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3108	4788	301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686.exe	84
PID 4788 wrote to memory of 3108	4788	301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686.exe	84
PID 4788 wrote to memory of 3108	4788	301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686.exe	84
PID 3108 wrote to memory of 2424	3108	vhst6994VG.exe	85
PID 3108 wrote to memory of 2424	3108	vhst6994VG.exe	85
PID 3108 wrote to memory of 4796	3108	vhst6994VG.exe	95
PID 3108 wrote to memory of 4796	3108	vhst6994VG.exe	95
PID 3108 wrote to memory of 4796	3108	vhst6994VG.exe	95

C:\Users\Admin\AppData\Local\Temp\301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686.exe
"C:\Users\Admin\AppData\Local\Temp\301ede0d52356c600e510493e741e36532aacc8b4864e188eed25beb3a8d3686.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhst6994VG.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhst6994VG.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf69Uh62LF97.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf69Uh62LF97.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf69Au82nf21.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf69Au82nf21.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhst6994VG.exe

Filesize
415KB

MD5
70a2ec60e00d4e13e0518468ad12e114

SHA1
68fb09aad760885f08726f71dd42d0a82d25ae7f

SHA256
2bd0ef984e31a564d6c37df3102d35fd62ba4003b0cf4470ea285549a4db28e6

SHA512
b0b69bed49853b329c947bf43f85d4ef5b30c56c6bb155c51e342aff7ccfe6915455d331045bd857eda003679f6ee6d1fd761fd2e2d5c1b78a68e6a428a94de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf69Uh62LF97.exe

Filesize
11KB

MD5
cf605ce1483b04336a810286d2774a46

SHA1
99711b2041f39879c8f5b7895ad283e080dd1047

SHA256
507a5b1c6383bf48782cc1d4b62220190c555c257c595604599dd8c1cd998606

SHA512
bbf05852d9e3231ee9c9bbc52bb24773cbba7fda0964cec946ec4bb0bb81cab82909d6c6d34a8661fda38a73ab9ce5af3f5308219bb6568128cb73784c5741dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf69Au82nf21.exe

Filesize
415KB

MD5
79645f4c4f6de9b74ca0120b7a2ff217

SHA1
e093a94b5415be8ebbc90a52807b811eb339823e

SHA256
cfa90800c04f1f257f52d7f8d63b001b37796b3f1da67b271d6c76feeda8306a

SHA512
13ae7f81ffa0ff1196334f870cdcaa7ac46be0bd6de36caceda5251b77a3dac0ccc8b33dc2ec7ca4a06bb96bf5017d68ea74ba373ebcdebf0e9318bb11803cd0

Download Submit
memory/2424-14-0x00007FFBE8773000-0x00007FFBE8775000-memory.dmp

Filesize
8KB

Download
memory/2424-15-0x0000000000760000-0x000000000076A000-memory.dmp

Filesize
40KB

Download
memory/2424-16-0x00007FFBE8773000-0x00007FFBE8775000-memory.dmp

Filesize
8KB

Download
memory/4796-64-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-52-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-24-0x0000000004EC0000-0x0000000004F04000-memory.dmp

Filesize
272KB

Download
memory/4796-58-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-74-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-88-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-86-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-84-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-82-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-80-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-78-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-76-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-72-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-70-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-68-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-66-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-22-0x0000000004E40000-0x0000000004E86000-memory.dmp

Filesize
280KB

Download
memory/4796-62-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-60-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-56-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-54-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-23-0x0000000007480000-0x0000000007A24000-memory.dmp

Filesize
5.6MB

Download
memory/4796-50-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-48-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-46-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-44-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-42-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-40-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-36-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-34-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-32-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-30-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-28-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-38-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-26-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-25-0x0000000004EC0000-0x0000000004EFE000-memory.dmp

Filesize
248KB

Download
memory/4796-931-0x0000000007A30000-0x0000000008048000-memory.dmp

Filesize
6.1MB

Download
memory/4796-932-0x0000000008050000-0x000000000815A000-memory.dmp

Filesize
1.0MB

Download
memory/4796-933-0x0000000007440000-0x0000000007452000-memory.dmp

Filesize
72KB

Download
memory/4796-934-0x0000000008160000-0x000000000819C000-memory.dmp

Filesize
240KB

Download
memory/4796-935-0x00000000082A0000-0x00000000082EC000-memory.dmp

Filesize
304KB

Download