healer | 9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe
Size

944KB
MD5

565c0c2ee53c4aa6e314afd8961dc10f
SHA1

96f590c1abecaa9bcc5974aabfe5380bd7fb4e08
SHA256

9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158
SHA512

fc6ef39e26fd4101d75eb48bc972825fa46224a7692089b1634224fa7733cd93f4688751a73c0ff2701b6c4ea6f2f8c2015cec632600be8dc6d2dc2ad1b4ce29
SSDEEP

24576:RyTV59f+wWjmlNeMqWbeMr3nOBJ8Y1IR2mKQi6:ETV59f+l6+Mr3guGIR2mvi

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3548-22-0x0000000004750000-0x000000000476A000-memory.dmp	healer
behavioral1/memory/3548-24-0x0000000004C40000-0x0000000004C58000-memory.dmp	healer
behavioral1/memory/3548-28-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-48-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-52-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-46-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-44-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-42-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-40-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-38-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-36-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-34-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-32-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-30-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-50-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-26-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer
behavioral1/memory/3548-25-0x0000000004C40000-0x0000000004C52000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr089729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr089729.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr089729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr089729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr089729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr089729.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1244-60-0x0000000006FF0000-0x000000000702C000-memory.dmp	family_redline
behavioral1/memory/1244-61-0x00000000077A0000-0x00000000077DA000-memory.dmp	family_redline
behavioral1/memory/1244-67-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-77-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-95-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-93-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-91-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-89-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-87-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-85-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-83-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-79-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-75-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-73-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-71-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-69-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-81-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-65-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-63-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline
behavioral1/memory/1244-62-0x00000000077A0000-0x00000000077D5000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
2100	un710246.exe
2424	un131376.exe
3548	pr089729.exe
1244	qu417453.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr089729.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr089729.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un710246.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un131376.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	3548	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un131376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr089729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu417453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un710246.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3548	pr089729.exe
3548	pr089729.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	pr089729.exe
Token: SeDebugPrivilege	1244	qu417453.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2100	552	9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe	83
PID 552 wrote to memory of 2100	552	9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe	83
PID 552 wrote to memory of 2100	552	9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe	83
PID 2100 wrote to memory of 2424	2100	un710246.exe	84
PID 2100 wrote to memory of 2424	2100	un710246.exe	84
PID 2100 wrote to memory of 2424	2100	un710246.exe	84
PID 2424 wrote to memory of 3548	2424	un131376.exe	85
PID 2424 wrote to memory of 3548	2424	un131376.exe	85
PID 2424 wrote to memory of 3548	2424	un131376.exe	85
PID 2424 wrote to memory of 1244	2424	un131376.exe	100
PID 2424 wrote to memory of 1244	2424	un131376.exe	100
PID 2424 wrote to memory of 1244	2424	un131376.exe	100

C:\Users\Admin\AppData\Local\Temp\9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe
"C:\Users\Admin\AppData\Local\Temp\9171bf602eed2cc060d9014d550c42fb7af707e20ccc3763cc93baa071e87158.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un710246.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un710246.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un131376.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un131376.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr089729.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr089729.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 1004
        5⤵
        Program crash
        
        PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu417453.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu417453.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3548 -ip 3548
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un710246.exe

Filesize
695KB

MD5
c77df77b063eb6e74914984bbe7fc021

SHA1
2ed9605b9fcf71b46f36d1aac59c72057818af1b

SHA256
459156213c370522d5baf00a2a7354508d6fdb82354d6f6dccafac364115673c

SHA512
8a817bd55b1f7311cfe889006fa7064919387219d76d203ccf55b7c814b5b692eb8d449653b85a4758b42420481317264ea5ff7aa8d7f8c0c31f88f30c5c9fa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un131376.exe

Filesize
541KB

MD5
96c451ca335e58b75e754fc6b89755c9

SHA1
8a868ca8a9d41d4ca4436d648485d334b0e4b345

SHA256
c930d2c3fd61ab9dbc3679b44a0429d4ba96164d299a9651708fa387705baae9

SHA512
40e39a066216b16550371a092f48877a18134114919ce0e48cbaca8c7ab120cfb66e457c6ba61ff994c50051ffe99362644d0846cf54b18a2bed68085e1351f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr089729.exe

Filesize
278KB

MD5
4cb3c1799218d62802eaf3b96e0059f7

SHA1
84913aeb2f3c9152220fe554a7968ce708315e28

SHA256
9e23f6ab583b85d039a1b0564b73835b2973635c24f5abc6342d31097bb1eb92

SHA512
755be8506200bb4d4956b0786ea6259aa7089c675c617800bc87bc167f62658ca6af5ff65b8193a0df6b0f023b1ae0d14ac3cdfa25e828fe3ec528b4f34f07e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu417453.exe

Filesize
361KB

MD5
99b5f39be7e1b3f3c28be09e37dc861a

SHA1
df4cae5bb284feaef3dc12ae0620cb15db0db161

SHA256
48cb90ffeec05f9222b3e407ac827447f231e7e388b286b44ff6c49d04a6e529

SHA512
c33e52522d656381aca43f48464d63b2049b52a0e7bf27f5b14a13df15af63573cd80f365f12e3046f2628fc60d9084997e0a0b27b89776cf283e72ca36f55aa

Download Submit
memory/1244-75-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-95-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-858-0x0000000006AE0000-0x0000000006B2C000-memory.dmp

Filesize
304KB

Download
memory/1244-857-0x000000000A490000-0x000000000A4CC000-memory.dmp

Filesize
240KB

Download
memory/1244-856-0x000000000A360000-0x000000000A46A000-memory.dmp

Filesize
1.0MB

Download
memory/1244-855-0x000000000A340000-0x000000000A352000-memory.dmp

Filesize
72KB

Download
memory/1244-854-0x0000000009CA0000-0x000000000A2B8000-memory.dmp

Filesize
6.1MB

Download
memory/1244-62-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-63-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-65-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-81-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-69-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-67-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-93-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-71-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-77-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-73-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-79-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-83-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-85-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-60-0x0000000006FF0000-0x000000000702C000-memory.dmp

Filesize
240KB

Download
memory/1244-61-0x00000000077A0000-0x00000000077DA000-memory.dmp

Filesize
232KB

Download
memory/1244-87-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-89-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/1244-91-0x00000000077A0000-0x00000000077D5000-memory.dmp

Filesize
212KB

Download
memory/3548-32-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-30-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-26-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-24-0x0000000004C40000-0x0000000004C58000-memory.dmp

Filesize
96KB

Download
memory/3548-55-0x0000000000400000-0x0000000002BA6000-memory.dmp

Filesize
39.6MB

Download
memory/3548-23-0x0000000007210000-0x00000000077B4000-memory.dmp

Filesize
5.6MB

Download
memory/3548-53-0x0000000000400000-0x0000000002BA6000-memory.dmp

Filesize
39.6MB

Download
memory/3548-22-0x0000000004750000-0x000000000476A000-memory.dmp

Filesize
104KB

Download
memory/3548-25-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-50-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-34-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-36-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-38-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-40-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-42-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-44-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-46-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-52-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-48-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download
memory/3548-28-0x0000000004C40000-0x0000000004C52000-memory.dmp

Filesize
72KB

Download