healer | 7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2.exe
Size

687KB
MD5

965a1be617b63b502b36acf070e2c1d4
SHA1

c7c6a7a671565e630d1f765667f4961cffd21a0c
SHA256

7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2
SHA512

b73028cd7bf53e3c19828c3195b18ecf47562731a6aa054078506c8f51dcfd6d1f0198ac8b9f6eee264cc93ddbc8e2dcc5d6f7d5abdb7b9cce72ed5b142512b7
SSDEEP

12288:1Mrgy90MQNQXvURWQkGsWYyhnQt13R61S7XIVckr+GooSRhUQQIfe4DE:ByDa33oyhQ/3R61ScVckanr3bDNg

Score

10^/10

healer redline boris discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

boris

193.233.20.32:4125

Attributes

auth_value
766b5bdf6dbefcf7ca223351952fc38f

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1488-18-0x0000000004BF0000-0x0000000004C0A000-memory.dmp	healer
behavioral1/memory/1488-20-0x0000000007260000-0x0000000007278000-memory.dmp	healer
behavioral1/memory/1488-48-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-46-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-44-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-42-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-41-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-38-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-36-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-34-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-32-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-31-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-28-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-26-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-24-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-22-0x0000000007260000-0x0000000007272000-memory.dmp	healer
behavioral1/memory/1488-21-0x0000000007260000-0x0000000007272000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6517.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6517.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1044-60-0x0000000004980000-0x00000000049C6000-memory.dmp	family_redline
behavioral1/memory/1044-61-0x0000000004C20000-0x0000000004C64000-memory.dmp	family_redline
behavioral1/memory/1044-79-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-95-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-93-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-91-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-89-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-87-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-85-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-83-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-81-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-77-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-75-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-73-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-71-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-69-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-67-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-65-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-63-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1044-62-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3028	un092574.exe
1488	pro6517.exe
1044	qu0936.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro6517.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6517.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un092574.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1488	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un092574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro6517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu0936.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	pro6517.exe
1488	pro6517.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	pro6517.exe
Token: SeDebugPrivilege	1044	qu0936.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3028	4016	7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2.exe	86
PID 4016 wrote to memory of 3028	4016	7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2.exe	86
PID 4016 wrote to memory of 3028	4016	7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2.exe	86
PID 3028 wrote to memory of 1488	3028	un092574.exe	87
PID 3028 wrote to memory of 1488	3028	un092574.exe	87
PID 3028 wrote to memory of 1488	3028	un092574.exe	87
PID 3028 wrote to memory of 1044	3028	un092574.exe	99
PID 3028 wrote to memory of 1044	3028	un092574.exe	99
PID 3028 wrote to memory of 1044	3028	un092574.exe	99

C:\Users\Admin\AppData\Local\Temp\7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2.exe
"C:\Users\Admin\AppData\Local\Temp\7e78533e71f4af5018548f24422dbe50d160bc89b3a7610248542e00b3f484c2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un092574.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un092574.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6517.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6517.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 1012
      4⤵
      Program crash
      PID:1496
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0936.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0936.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1488 -ip 1488
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un092574.exe

Filesize
545KB

MD5
aa73cd02f3b3b67a39124339e8b6f81c

SHA1
51e2dd6d6c56c6aa65e99d99696c18d2dab09555

SHA256
78399206082cf7e6df270f857fe1aa21b4fbe98ff188e6d5f8b163fb39fb9f85

SHA512
90b9280723edd2f40fd66e426d9889b85e7ccaf28f16367f56007d3b23fb8245a5ba83339e0276ece4d8fcf0b34fa7c79a48c400ef978e8fa0aada34110b5203

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6517.exe

Filesize
325KB

MD5
d28389769a71fc7c10b8c90e340c2789

SHA1
638fc9aa1d5775382f767dd76dc81b284fb110fb

SHA256
beb5d01f5eac6a1ac3e0b07f98d34beac0f9405c77bf964aad275a691e38a153

SHA512
5f2611e9e74c7c6c43f319d87a6b1d7ad3a2843cf0b748fbd01ddfcfcfe2bf000eb738faa18b8e608cf4dace15710b296dc8a9a4b3a99c59b18d69043bae0f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0936.exe

Filesize
383KB

MD5
dec92a2f1c30674e4c4bf0cae2a7b6a5

SHA1
a06588ba7ee54518be8a372f307feeb91a16451f

SHA256
f2abdfb99bb6e8e9c1835d69c0f6a54c7cbb7a6dc2a3e136fd09aa0904a00313

SHA512
f3425dc190006ffa4e1cc86ba361ea4b4bc3747094c2a8626d1359b6fe7b9d0de144cb33b44da7f80d87acaafd1dacb9ed01cb05a583eb39fe81e0599dde8a4c

Download Submit
memory/1044-73-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-77-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-969-0x0000000007EF0000-0x0000000007FFA000-memory.dmp

Filesize
1.0MB

Download
memory/1044-968-0x00000000078D0000-0x0000000007EE8000-memory.dmp

Filesize
6.1MB

Download
memory/1044-62-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-63-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-65-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-67-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-69-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-71-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-971-0x0000000004D90000-0x0000000004DCC000-memory.dmp

Filesize
240KB

Download
memory/1044-972-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download
memory/1044-75-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-970-0x0000000004D70000-0x0000000004D82000-memory.dmp

Filesize
72KB

Download
memory/1044-81-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-83-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-85-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-87-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-89-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-91-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-93-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-95-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-79-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1044-61-0x0000000004C20000-0x0000000004C64000-memory.dmp

Filesize
272KB

Download
memory/1044-60-0x0000000004980000-0x00000000049C6000-memory.dmp

Filesize
280KB

Download
memory/1488-38-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-54-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/1488-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1488-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1488-51-0x0000000002C60000-0x0000000002C8D000-memory.dmp

Filesize
180KB

Download
memory/1488-50-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/1488-49-0x0000000002CB0000-0x0000000002DB0000-memory.dmp

Filesize
1024KB

Download
memory/1488-21-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-22-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-24-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-26-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-28-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-31-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-32-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-34-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-36-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-41-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-42-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-44-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-46-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-48-0x0000000007260000-0x0000000007272000-memory.dmp

Filesize
72KB

Download
memory/1488-20-0x0000000007260000-0x0000000007278000-memory.dmp

Filesize
96KB

Download
memory/1488-19-0x0000000007370000-0x0000000007914000-memory.dmp

Filesize
5.6MB

Download
memory/1488-18-0x0000000004BF0000-0x0000000004C0A000-memory.dmp

Filesize
104KB

Download
memory/1488-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1488-16-0x0000000002C60000-0x0000000002C8D000-memory.dmp

Filesize
180KB

Download
memory/1488-15-0x0000000002CB0000-0x0000000002DB0000-memory.dmp

Filesize
1024KB

Download