healer | b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe
Size

893KB
MD5

d018e68c6c82a5a61f89b6b10e21e52b
SHA1

d4b4706a21d9114ef02c5b03b58d5a4184dad8ef
SHA256

b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624
SHA512

f91d841fdf55fd6bb87b53597ffa831272173d4f5fc995a10986d5c42862207d99ae8ca70a0359690905d16e207b2339d2bfeb2f216812ccbc3334a53f2fd1f2
SSDEEP

24576:/yVCMz0kM/2V9t0htk+SFFnkbQjkUOXjL70aKKpRsj:KsgPtmn0FYjL73R

Score

10^/10

healer redline dark discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dark

185.161.248.73:4164

Attributes

auth_value
ae85b01f66afe8770afeed560513fc2d

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/1564-2149-0x0000000005430000-0x000000000543A000-memory.dmp	healer
behavioral1/files/0x000a000000023b9f-2155.dat	healer
behavioral1/memory/3264-2163-0x0000000000E40000-0x0000000000E4A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/5304-4317-0x0000000002AF0000-0x0000000002B22000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b9b-4322.dat	family_redline
behavioral1/memory/1820-4324-0x0000000000DB0000-0x0000000000DE0000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	84457733.exe

Executes dropped EXE 5 IoCs

pid	Process
4428	st749789.exe
1564	84457733.exe
3264	1.exe
5304	kp630431.exe
1820	lr967780.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	st749789.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1192	5304	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	st749789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84457733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kp630431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lr967780.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3264	1.exe
3264	1.exe
3264	1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	84457733.exe
Token: SeDebugPrivilege	5304	kp630431.exe
Token: SeDebugPrivilege	3264	1.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4428	4776	b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe	84
PID 4776 wrote to memory of 4428	4776	b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe	84
PID 4776 wrote to memory of 4428	4776	b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe	84
PID 4428 wrote to memory of 1564	4428	st749789.exe	85
PID 4428 wrote to memory of 1564	4428	st749789.exe	85
PID 4428 wrote to memory of 1564	4428	st749789.exe	85
PID 1564 wrote to memory of 3264	1564	84457733.exe	89
PID 1564 wrote to memory of 3264	1564	84457733.exe	89
PID 4428 wrote to memory of 5304	4428	st749789.exe	90
PID 4428 wrote to memory of 5304	4428	st749789.exe	90
PID 4428 wrote to memory of 5304	4428	st749789.exe	90
PID 4776 wrote to memory of 1820	4776	b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe	99
PID 4776 wrote to memory of 1820	4776	b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe	99
PID 4776 wrote to memory of 1820	4776	b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe	99

C:\Users\Admin\AppData\Local\Temp\b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe
"C:\Users\Admin\AppData\Local\Temp\b095c625aa281f3caafe6438346fc65ee4c19e22e3a365615b41929788f0f624.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st749789.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st749789.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84457733.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84457733.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp630431.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp630431.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 1236
      4⤵
      Program crash
      PID:1192
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr967780.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr967780.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5304 -ip 5304
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr967780.exe

Filesize
169KB

MD5
bc108f0bfd37d0b03a7242742f4f28a4

SHA1
8580d11e60cb33a210423017716dce773a587771

SHA256
2120f8f1b34bf88be4908e93bf5d2f4d483973d9476f84598e70637083797cf3

SHA512
27939f645b3179010badfb5776e35a7d7d69d765ef6856888ffc6acc2705a8c3b377c3c1bcf4a3bd0023d65f6698f46b1bca29cececf41ee53eafe0ef01624cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st749789.exe

Filesize
740KB

MD5
379b5c5e7cd00e53a1e0508a41e1d6d7

SHA1
f271a30360aee1d441e0193c39e8a667bf86a649

SHA256
b7d76ee158d7872c6f14002a674529707a72bfc8257ad539afcbe17b619d1b3e

SHA512
aed7880f6e2fbd334a5203e58887d5561ed2ce38d6fa2e54ba26ea1b940e21c9551907da0b4d2cbd3439b6ad5e602b5aad987cd08f3d4caedbc37dc12282a80d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84457733.exe

Filesize
302KB

MD5
8631bf701ec8443e847eddca5554acb2

SHA1
bddf4476b427189be8d669e0adbb8257e59a1995

SHA256
04b01740e6e9f45c3fffc559788e35d751608f2cba527e4a858525cbfe2acdc3

SHA512
274eec949e0c1e9211e620b024e79ed3560c05a21c3fb7351da2796ba5ca1619544010cf3f40d946c36752eaf30aac026942b417b165ab3d191c1ca009c39c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp630431.exe

Filesize
582KB

MD5
d7a7f5091e8e668b22ce18e964805845

SHA1
4528f533f67bc27109faa0272b19923acf6964c0

SHA256
d1faba007b36a7c3b6e7682ba0b7e3cb931d5b740c278f9d966e1c08f6fc4a2c

SHA512
525fc47aacc8644948963cbce14ac59a3b8dbe5c9e5be6e7862e533fa11c55bbd97f716ccc6f783c606d6773314c3ede2e80b0340a6822980ce50941b8e500e6

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1564-46-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-2149-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/1564-18-0x0000000004B20000-0x0000000004B76000-memory.dmp

Filesize
344KB

Download
memory/1564-61-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-25-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-23-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-77-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-75-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-74-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-71-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-84-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-82-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-79-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-80-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-69-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-67-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-65-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-63-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-59-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-57-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-56-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-53-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-43-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-49-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-47-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-17-0x0000000004BA0000-0x0000000005144000-memory.dmp

Filesize
5.6MB

Download
memory/1564-51-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-42-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-19-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-37-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-35-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-33-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-32-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-29-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-27-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-21-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-20-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-39-0x0000000004B20000-0x0000000004B71000-memory.dmp

Filesize
324KB

Download
memory/1564-2151-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-16-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-14-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/1564-2164-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/1564-15-0x0000000004A50000-0x0000000004AA8000-memory.dmp

Filesize
352KB

Download
memory/1820-4324-0x0000000000DB0000-0x0000000000DE0000-memory.dmp

Filesize
192KB

Download
memory/1820-4325-0x0000000001740000-0x0000000001746000-memory.dmp

Filesize
24KB

Download
memory/1820-4326-0x0000000005DB0000-0x00000000063C8000-memory.dmp

Filesize
6.1MB

Download
memory/1820-4327-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/1820-4328-0x0000000005620000-0x0000000005632000-memory.dmp

Filesize
72KB

Download
memory/1820-4329-0x0000000005790000-0x00000000057CC000-memory.dmp

Filesize
240KB

Download
memory/1820-4330-0x00000000057E0000-0x000000000582C000-memory.dmp

Filesize
304KB

Download
memory/3264-2163-0x0000000000E40000-0x0000000000E4A000-memory.dmp

Filesize
40KB

Download
memory/5304-2169-0x0000000002820000-0x0000000002888000-memory.dmp

Filesize
416KB

Download
memory/5304-2170-0x0000000002930000-0x0000000002996000-memory.dmp

Filesize
408KB

Download
memory/5304-4317-0x0000000002AF0000-0x0000000002B22000-memory.dmp

Filesize
200KB

Download
memory/5304-4318-0x00000000057A0000-0x0000000005832000-memory.dmp

Filesize
584KB

Download