healer | b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a.exe
Size

1.0MB
MD5

adb060fa1374a212355529ef044e2484
SHA1

53694464de0e1a748440b50005b401240e62acb8
SHA256

b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a
SHA512

a3859a79288d6e5087c1917f5c304f6610f1717b9fc7bc8fa5de7e85def752ccdd56d2032559cb0d1b72e245c74ac1a8cc1f75873fff15941f38495db308d9b0
SSDEEP

24576:xyhOi27ILV3Q54lDpoQZYvPWAsWWCXrsgmBdhNkYt7ON:khfP3Q5+7amPYXggWO

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3620-23-0x0000000002780000-0x000000000279A000-memory.dmp	healer
behavioral1/memory/3620-25-0x0000000004DA0000-0x0000000004DB8000-memory.dmp	healer
behavioral1/memory/3620-53-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-51-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-47-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-39-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-27-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/3620-26-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr178941.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr178941.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr178941.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr178941.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr178941.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr178941.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1988-62-0x0000000002800000-0x000000000283C000-memory.dmp	family_redline
behavioral1/memory/1988-63-0x0000000004E10000-0x0000000004E4A000-memory.dmp	family_redline
behavioral1/memory/1988-75-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-97-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-95-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-93-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-91-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-89-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-87-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-85-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-83-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-81-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-79-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-77-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-73-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-71-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-69-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-67-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-65-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/1988-64-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4492	un730204.exe
4972	un368033.exe
3620	pr178941.exe
1988	qu754103.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr178941.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr178941.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un730204.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un368033.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	3620	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr178941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu754103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un730204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un368033.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3620	pr178941.exe
3620	pr178941.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	pr178941.exe
Token: SeDebugPrivilege	1988	qu754103.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4492	1496	b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a.exe	84
PID 1496 wrote to memory of 4492	1496	b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a.exe	84
PID 1496 wrote to memory of 4492	1496	b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a.exe	84
PID 4492 wrote to memory of 4972	4492	un730204.exe	85
PID 4492 wrote to memory of 4972	4492	un730204.exe	85
PID 4492 wrote to memory of 4972	4492	un730204.exe	85
PID 4972 wrote to memory of 3620	4972	un368033.exe	86
PID 4972 wrote to memory of 3620	4972	un368033.exe	86
PID 4972 wrote to memory of 3620	4972	un368033.exe	86
PID 4972 wrote to memory of 1988	4972	un368033.exe	98
PID 4972 wrote to memory of 1988	4972	un368033.exe	98
PID 4972 wrote to memory of 1988	4972	un368033.exe	98

C:\Users\Admin\AppData\Local\Temp\b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a.exe
"C:\Users\Admin\AppData\Local\Temp\b896c1fa2f1af00e61f4eaba3d23f3a2add81b6b5315f14089d314ca927b612a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un730204.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un730204.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un368033.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un368033.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr178941.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr178941.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3620
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 1080
        5⤵
        Program crash
        
        PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu754103.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu754103.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3620 -ip 3620
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un730204.exe

Filesize
761KB

MD5
8a60494ce5eaa19cf0da119fc192b304

SHA1
2acfee6ff514aec5bb11bab15a6b5dbe17f5a964

SHA256
9de3ae74214953569128cc79e8d6a410d43060e17e57e5907b0b4d68ff5d1869

SHA512
b6df0fa398e784eaa3e8de6626a92404e8703f5b8c6cf479fdafa3462d1badaf7441d1d4ab91941fc6106b365b1011563c54d5258b500c650f6b718b8bc4bcb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un368033.exe

Filesize
608KB

MD5
09269ceb20dfc0bf5b4e99a1350849f1

SHA1
f132b5835d365a3e0f747d4e87e638480646a81a

SHA256
bcc9b90ee96fe8a533588571bb289ab5c4b1b79b89148f889dcc5522209133d7

SHA512
70402062fad720565db7fc92454a9d7fb21f6866590f64cbd616756f4c9ae04354499feeed2deda6b948cc81b0ef9b0a41bdbbfcf04b688930564174b035652b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr178941.exe

Filesize
405KB

MD5
222b69a2b65eb01320129cbb431aaf15

SHA1
87bd300a7ee56b7d67d147806b23275a14505e6c

SHA256
7255d77c9da1141c271f81dfca5be49f880192b930b1835acfe96d3f3f4e111a

SHA512
71f78f1ac68e5e86832dc46908b5e61b635efc2bbc5b1fa13be60a7840273dbadd200b3be054e7369a777a8e2933fc01fd0540a951eb838ea025383d885a8a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu754103.exe

Filesize
487KB

MD5
e3795d527f4cefe87dec80967995aa96

SHA1
67e702cb9fa4e93b4d6cca993061a6e7af63ca55

SHA256
dbb26b68de9ae5c3cecbc35587166d96c2781bf61d54875b4d08e2b37d36d9a1

SHA512
13b35decd606f7c26520460cd79326b35c11c0c90c75523055f16e38f032e286715d27fd8ad6631cfe8d8860ba434a0f4c54e588678692b518a7e09bbecae2f8

Download Submit
memory/1988-73-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-81-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-857-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/1988-856-0x0000000007980000-0x0000000007F98000-memory.dmp

Filesize
6.1MB

Download
memory/1988-64-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-65-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-67-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-69-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-859-0x00000000080E0000-0x000000000811C000-memory.dmp

Filesize
240KB

Download
memory/1988-71-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-97-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-77-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-79-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-858-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/1988-83-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-85-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-87-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-89-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-91-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-93-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-95-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1988-860-0x0000000002700000-0x000000000274C000-memory.dmp

Filesize
304KB

Download
memory/1988-62-0x0000000002800000-0x000000000283C000-memory.dmp

Filesize
240KB

Download
memory/1988-63-0x0000000004E10000-0x0000000004E4A000-memory.dmp

Filesize
232KB

Download
memory/1988-75-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/3620-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-57-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/3620-54-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/3620-55-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download
memory/3620-26-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-27-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-39-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-47-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-51-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-53-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/3620-25-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

Filesize
96KB

Download
memory/3620-24-0x0000000004EC0000-0x0000000005464000-memory.dmp

Filesize
5.6MB

Download
memory/3620-23-0x0000000002780000-0x000000000279A000-memory.dmp

Filesize
104KB

Download
memory/3620-22-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download