healer | f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867.exe
Size

682KB
MD5

c762ca176956d9f465c97ec4dfef50f5
SHA1

08416925697565fc9eddd74cb3210d81aa8b11b5
SHA256

f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867
SHA512

67d455d27685166d4cf63e70fae8b43bcdc911afeeced97c47fb5955f1b598d3965b4d11ceaa8eeefdbc03428dff712b36626f20e54d633e757b2f8bd0c21aa8
SSDEEP

12288:tMrvy90WZF3Ul+xdmn6JWQUhxk3BNZDvILx/ZD6h0NMqeKI9xtUQ:yyj4+xLTUhxeW/e0NMqeKutUQ

Score

10^/10

healer redline sony discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

sony

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4252-17-0x0000000007060000-0x000000000707A000-memory.dmp	healer
behavioral1/memory/4252-19-0x0000000007090000-0x00000000070A8000-memory.dmp	healer
behavioral1/memory/4252-46-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-44-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-42-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-40-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-38-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-36-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-34-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-32-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-30-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-28-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-26-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-24-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-22-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-21-0x0000000007090000-0x00000000070A2000-memory.dmp	healer
behavioral1/memory/4252-48-0x0000000007090000-0x00000000070A2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2130.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2130.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2130.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2130.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2130.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2130.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1184-60-0x0000000004990000-0x00000000049D6000-memory.dmp	family_redline
behavioral1/memory/1184-61-0x0000000004C90000-0x0000000004CD4000-memory.dmp	family_redline
behavioral1/memory/1184-69-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-75-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-73-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-71-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-67-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-65-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-89-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-63-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-62-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-95-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-93-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-91-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-87-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-86-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-83-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-81-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-79-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline
behavioral1/memory/1184-77-0x0000000004C90000-0x0000000004CCE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2480	un240872.exe
4252	pro2130.exe
1184	qu0810.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro2130.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2130.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un240872.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro2130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu0810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un240872.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4252	pro2130.exe
4252	pro2130.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	pro2130.exe
Token: SeDebugPrivilege	1184	qu0810.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2480	4612	f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867.exe	85
PID 4612 wrote to memory of 2480	4612	f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867.exe	85
PID 4612 wrote to memory of 2480	4612	f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867.exe	85
PID 2480 wrote to memory of 4252	2480	un240872.exe	86
PID 2480 wrote to memory of 4252	2480	un240872.exe	86
PID 2480 wrote to memory of 4252	2480	un240872.exe	86
PID 2480 wrote to memory of 1184	2480	un240872.exe	94
PID 2480 wrote to memory of 1184	2480	un240872.exe	94
PID 2480 wrote to memory of 1184	2480	un240872.exe	94

C:\Users\Admin\AppData\Local\Temp\f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867.exe
"C:\Users\Admin\AppData\Local\Temp\f9e813df0973d30225cd20811f4a16307c2376058dd4b8a5842f84c107d0f867.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240872.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240872.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2130.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2130.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0810.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0810.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un240872.exe

Filesize
540KB

MD5
94a5205ca2e9564ac56ceacfc9321571

SHA1
9a280350ef1d3328b35c9efe3ef4faefd63eebc0

SHA256
739d188b60f0998323c7cd19da22cdbcdbd3ca2a946a688cf2b0111804d0771e

SHA512
848af2de0ca17e7242eac002ecf9bd1bea69f4846f41a2716d436cb7763352126df137bb2611ae3e8cdeecd88236b9ebd6113a98b38957930af837509a6480b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2130.exe

Filesize
322KB

MD5
f912ea280e58b4da96190ee4fc602299

SHA1
43965378819ff224ff1c6f12d825e0981bc5cfdc

SHA256
36cb90326983b0412be6c2dea592e3cd6813066c4ac5c416475ca21780eaf1be

SHA512
c7dd79d8e22c53b344f8a39f9170c7153fa5f3b39df3c20b4bf722dd13d49d065571a1706b96a8f81cae49070828200ab60df24169a8f70fc06b924e1d40601c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0810.exe

Filesize
379KB

MD5
2ba0f7b41cb8234d3cbe0d0d24135757

SHA1
3669e4dec735c68397736d1e80bc1c29a6e6f820

SHA256
9ee9e4f2a7d85f6b817fc634c1c21b6c5738f314d064cefea6191b4fc05cc5f4

SHA512
22bf41cfa543f42d25e563d850e7de3e6b018c32efb22a15f66b5e4991790d1306b635a8fc7e23c98fa4f394b76a9bd91cdebfaddad498486fa82d099fd4ec9d

Download Submit
memory/1184-91-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-95-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-969-0x0000000007ED0000-0x0000000007FDA000-memory.dmp

Filesize
1.0MB

Download
memory/1184-968-0x00000000078B0000-0x0000000007EC8000-memory.dmp

Filesize
6.1MB

Download
memory/1184-77-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-79-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-81-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-83-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-86-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-87-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-971-0x0000000007FE0000-0x000000000801C000-memory.dmp

Filesize
240KB

Download
memory/1184-972-0x0000000008130000-0x000000000817C000-memory.dmp

Filesize
304KB

Download
memory/1184-93-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-970-0x0000000004D90000-0x0000000004DA2000-memory.dmp

Filesize
72KB

Download
memory/1184-62-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-63-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-89-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-65-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-67-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-71-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-73-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-75-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-69-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/1184-61-0x0000000004C90000-0x0000000004CD4000-memory.dmp

Filesize
272KB

Download
memory/1184-60-0x0000000004990000-0x00000000049D6000-memory.dmp

Filesize
280KB

Download
memory/4252-36-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-54-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4252-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4252-50-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4252-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4252-49-0x0000000002D00000-0x0000000002E00000-memory.dmp

Filesize
1024KB

Download
memory/4252-48-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-21-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-22-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-24-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-26-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-28-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-30-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-32-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-34-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-38-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-40-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-42-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-44-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-46-0x0000000007090000-0x00000000070A2000-memory.dmp

Filesize
72KB

Download
memory/4252-20-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4252-19-0x0000000007090000-0x00000000070A8000-memory.dmp

Filesize
96KB

Download
memory/4252-18-0x0000000007100000-0x00000000076A4000-memory.dmp

Filesize
5.6MB

Download
memory/4252-17-0x0000000007060000-0x000000000707A000-memory.dmp

Filesize
104KB

Download
memory/4252-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4252-15-0x0000000002D00000-0x0000000002E00000-memory.dmp

Filesize
1024KB

Download