healer | 10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe
Size

933KB
MD5

7c87f3bc95e9a73fda4364671b6ca00b
SHA1

ad0d0b9d08e0f52fcc99cf4091bfc005c0be7221
SHA256

10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9
SHA512

73fe49c41aa00ac5cd6d32cd2b4ce85e338a5354f84a29d4c94b1429eb68941d6b04b7eb92db6ef3141274c7314ebef6435dd0749a85715ca1dbe6d723fb080f
SSDEEP

24576:Gysb36TQNliW02DNOWjOQKiBZA91FSkjaGNLz8CgJ:Vsb3myliVG0WjOli3AvFfjLNng

Score

10^/10

healer redline dark discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dark

185.161.248.73:4164

Attributes

auth_value
ae85b01f66afe8770afeed560513fc2d

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/4744-2150-0x0000000005730000-0x000000000573A000-memory.dmp	healer
behavioral1/files/0x000c000000023b43-2155.dat	healer
behavioral1/memory/5440-2163-0x0000000000310000-0x000000000031A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/5716-4319-0x0000000005770000-0x00000000057A2000-memory.dmp	family_redline
behavioral1/files/0x0007000000023c7d-4325.dat	family_redline
behavioral1/memory/4340-4326-0x0000000000810000-0x0000000000840000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	99264574.exe

Executes dropped EXE 5 IoCs

pid	Process
2840	un106814.exe
4744	99264574.exe
5440	1.exe
5716	rk138139.exe
4340	si611051.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un106814.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5608	4744	WerFault.exe	87
3408	5716	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rk138139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si611051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un106814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99264574.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5440	1.exe
5440	1.exe
5440	1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	99264574.exe
Token: SeDebugPrivilege	5716	rk138139.exe
Token: SeDebugPrivilege	5440	1.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2840	4076	10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe	85
PID 4076 wrote to memory of 2840	4076	10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe	85
PID 4076 wrote to memory of 2840	4076	10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe	85
PID 2840 wrote to memory of 4744	2840	un106814.exe	87
PID 2840 wrote to memory of 4744	2840	un106814.exe	87
PID 2840 wrote to memory of 4744	2840	un106814.exe	87
PID 4744 wrote to memory of 5440	4744	99264574.exe	90
PID 4744 wrote to memory of 5440	4744	99264574.exe	90
PID 2840 wrote to memory of 5716	2840	un106814.exe	94
PID 2840 wrote to memory of 5716	2840	un106814.exe	94
PID 2840 wrote to memory of 5716	2840	un106814.exe	94
PID 4076 wrote to memory of 4340	4076	10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe	100
PID 4076 wrote to memory of 4340	4076	10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe	100
PID 4076 wrote to memory of 4340	4076	10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe	100

C:\Users\Admin\AppData\Local\Temp\10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe
"C:\Users\Admin\AppData\Local\Temp\10c7b3e365efde42f07adcc2ae3982cefe0f3beace85d7ccb5244958317e5ed9.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un106814.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un106814.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99264574.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99264574.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1384
      4⤵
      Program crash
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk138139.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk138139.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 1268
      4⤵
      Program crash
      PID:3408
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si611051.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si611051.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4744 -ip 4744
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5716 -ip 5716
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si611051.exe

Filesize
170KB

MD5
425361edb9ef7702aa685f518705bdba

SHA1
54b663627daac9022d0d5b755aeef63a15a39078

SHA256
36f8a24c844e4ebe022a0f5ea9e130d5511bb05a70265173ca1021bb9a362928

SHA512
6eac2224adadb2bcf6d7ca6056cf159eda57eb5512e1060e92e36d4ae9faff59dbc889cdf7f977c396257b41e8154ed9b0a0180d15aee7fc9b23ce819a246bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un106814.exe

Filesize
779KB

MD5
676afe3cdfb997d0f7c766aa11f673c2

SHA1
be5176b2751bfa10f6510efbd36dbd7f51f972df

SHA256
1602eaf4700f3c34b32117a38601ab897be37c1b18442ad49a2e66e5de324dd3

SHA512
b5f3109da857586f88e67884effdf56871ce6a792b7bb558d3e3c3099a6987da1435bd8d8292c05cf1083697b4d3346b7d395e53bf9bc56edd57ce732ae2828a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\99264574.exe

Filesize
521KB

MD5
6917ce2a1f8fd359cdf2d8429d3b7473

SHA1
fd02967c22439b253c6867166811608021e2e8ea

SHA256
2e51f086081096f672aee4aab7327a01918aeb9512b86d0f99266dfbab70ebc6

SHA512
1482558d639fb61340447c1686e5bfad9453d8720097aec32c8cfc3a2b87862cd0b18845074b0576f27fcdb16c28668c06f1b305d1dd811aedda493110d931c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk138139.exe

Filesize
581KB

MD5
d171ff73c550a6b8d5b8f0a0d62d02ab

SHA1
a1d37dcfd17d7cdab2668b87af79d5c51af4864d

SHA256
45cd8db9d0396651529ffe5c78b4dc06769b087bd63bb0d6187429e110bd1def

SHA512
3cb44cd090922842fa8d2eebb0ec491c7306c464187287d79e881f0d7838de8ee7517d8c6e1236d4255bf0c867e5d058227aead9bacf5e50314bad7d53eb7023

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/4340-4332-0x0000000004A10000-0x0000000004A5C000-memory.dmp

Filesize
304KB

Download
memory/4340-4331-0x000000000A610000-0x000000000A64C000-memory.dmp

Filesize
240KB

Download
memory/4340-4330-0x000000000A5B0000-0x000000000A5C2000-memory.dmp

Filesize
72KB

Download
memory/4340-4329-0x000000000A690000-0x000000000A79A000-memory.dmp

Filesize
1.0MB

Download
memory/4340-4328-0x000000000ABA0000-0x000000000B1B8000-memory.dmp

Filesize
6.1MB

Download
memory/4340-4327-0x00000000028B0000-0x00000000028B6000-memory.dmp

Filesize
24KB

Download
memory/4340-4326-0x0000000000810000-0x0000000000840000-memory.dmp

Filesize
192KB

Download
memory/4744-31-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-27-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-77-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-75-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-73-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-69-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-67-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-63-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-61-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-59-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-55-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-53-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-51-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-49-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-45-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-37-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-35-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-33-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-85-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-83-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-29-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-79-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-71-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-81-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-65-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-25-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-57-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-23-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-43-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-22-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-2150-0x0000000005730000-0x000000000573A000-memory.dmp

Filesize
40KB

Download
memory/4744-47-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-15-0x00000000008C0000-0x00000000009C0000-memory.dmp

Filesize
1024KB

Download
memory/4744-2165-0x0000000000400000-0x0000000000828000-memory.dmp

Filesize
4.2MB

Download
memory/4744-2166-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4744-39-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-16-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4744-17-0x0000000000400000-0x0000000000828000-memory.dmp

Filesize
4.2MB

Download
memory/4744-18-0x0000000000400000-0x0000000000828000-memory.dmp

Filesize
4.2MB

Download
memory/4744-19-0x0000000002720000-0x0000000002778000-memory.dmp

Filesize
352KB

Download
memory/4744-41-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/4744-21-0x0000000005520000-0x0000000005576000-memory.dmp

Filesize
344KB

Download
memory/4744-20-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/5440-2163-0x0000000000310000-0x000000000031A000-memory.dmp

Filesize
40KB

Download
memory/5716-4320-0x00000000057A0000-0x0000000005832000-memory.dmp

Filesize
584KB

Download
memory/5716-4319-0x0000000005770000-0x00000000057A2000-memory.dmp

Filesize
200KB

Download
memory/5716-2172-0x0000000005580000-0x00000000055E6000-memory.dmp

Filesize
408KB

Download
memory/5716-2171-0x0000000002920000-0x0000000002988000-memory.dmp

Filesize
416KB

Download