healer | 12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe
Size

562KB
MD5

69786bafc55c3199ddea2ebc7070bb6d
SHA1

b097b5bed9db649e5136ba7d4285acbcc2b53085
SHA256

12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0
SHA512

8790aacdf4fef7d9d81ad5a945e75df830db7ff8100624fc77c1020a028fe11617b0192a070254d8f49707b508d6f736c8d1926065018506383399c9cd8518a6
SSDEEP

12288:dMr/y90A0WVPm8529SlLnZuYYyq0JcxvwUOGmyIKCc:CyfVPTM9AnZI0Jcx4UOLyIKCc

Score

10^/10

healer redline fabio fud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

fabio

193.233.20.27:4123

Attributes

auth_value
56b82736c3f56b13be8e64c87d2cf9e5

Extracted

Family

redline

Botnet

fud

193.233.20.27:4123

Attributes

auth_value
cddc991efd6918ad5321d80dac884b40

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cbe-12.dat	healer
behavioral1/memory/4724-15-0x00000000007D0000-0x00000000007DA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sf93Pz41Df20.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sf93Pz41Df20.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sf93Pz41Df20.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sf93Pz41Df20.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sf93Pz41Df20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sf93Pz41Df20.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023cbc-25.dat	family_redline
behavioral1/memory/2032-30-0x0000000000140000-0x0000000000172000-memory.dmp	family_redline
behavioral1/memory/4532-31-0x0000000002360000-0x00000000023A6000-memory.dmp	family_redline
behavioral1/memory/4532-33-0x0000000004F90000-0x0000000004FD4000-memory.dmp	family_redline
behavioral1/memory/4532-37-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-43-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-94-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-91-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-87-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-85-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-83-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-81-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-79-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-77-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-75-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-73-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-69-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-67-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-65-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-63-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-61-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-59-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-57-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-55-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-53-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-49-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-47-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-45-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-41-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-39-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-89-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-71-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-51-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-35-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline
behavioral1/memory/4532-34-0x0000000004F90000-0x0000000004FCE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
372	vhLO2753XS.exe
4724	sf93Pz41Df20.exe
4200	tf35TL09tr75.exe
4532	tf35TL09tr75.exe
2032	uhMm44vq61lT.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	sf93Pz41Df20.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vhLO2753XS.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4200 set thread context of 4532	4200	tf35TL09tr75.exe	95

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3252	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tf35TL09tr75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vhLO2753XS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tf35TL09tr75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uhMm44vq61lT.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4724	sf93Pz41Df20.exe
4724	sf93Pz41Df20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	sf93Pz41Df20.exe
Token: SeDebugPrivilege	4532	tf35TL09tr75.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 372	1436	12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe	83
PID 1436 wrote to memory of 372	1436	12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe	83
PID 1436 wrote to memory of 372	1436	12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe	83
PID 372 wrote to memory of 4724	372	vhLO2753XS.exe	84
PID 372 wrote to memory of 4724	372	vhLO2753XS.exe	84
PID 372 wrote to memory of 4200	372	vhLO2753XS.exe	94
PID 372 wrote to memory of 4200	372	vhLO2753XS.exe	94
PID 372 wrote to memory of 4200	372	vhLO2753XS.exe	94
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 4200 wrote to memory of 4532	4200	tf35TL09tr75.exe	95
PID 1436 wrote to memory of 2032	1436	12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe	96
PID 1436 wrote to memory of 2032	1436	12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe	96
PID 1436 wrote to memory of 2032	1436	12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe	96

C:\Users\Admin\AppData\Local\Temp\12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe
"C:\Users\Admin\AppData\Local\Temp\12fd15641bfeb987b60d252bbb25e8fc7ea2649154ee4ab1283b51993fa327f0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhLO2753XS.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhLO2753XS.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf93Pz41Df20.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf93Pz41Df20.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf35TL09tr75.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf35TL09tr75.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf35TL09tr75.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf35TL09tr75.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhMm44vq61lT.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhMm44vq61lT.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2032

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhMm44vq61lT.exe

Filesize
176KB

MD5
6c38f9d9b46c3199a90012986f4f2de7

SHA1
ac91156ffa0288369bde0dc88403cd34dea6a808

SHA256
ba995c6f7813b7a355e482f112ce3ba26fe3fec95d6750235be29683888727d4

SHA512
3881d7321524940944323a042b11f80bab723da8b33189f682d51965225d3a9039efb95bca9bec47dfb61f96ef7e5bb3299ddae04bcc96104382c7dab3e161ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhLO2753XS.exe

Filesize
417KB

MD5
e0d64711783717b938a7b6dfe529baf8

SHA1
43fb4b789fd90038f0938d985ae659d1d212a16f

SHA256
24a76821cdca4fcc4ee468b2663ecd075385e111277461fe15a2af145b204ab1

SHA512
507f7137e6853d03b1b991214d7bd65f15f060cf40dd1198a9afdb490d1bd7f0ecc54e9f306e9c70d6307a695bd266fe6c78b618b6788fa2c773fb53ad2ee551

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf93Pz41Df20.exe

Filesize
12KB

MD5
70d8434b45ec16b90bf1b6af61bc769c

SHA1
60a1139df070b33d8f99dda76b2a647a4cb34700

SHA256
ff3984afd8f986582748afc5af2832e06b5d852f1abace15ff208ae4e00584f9

SHA512
db1616c4457f8161d93bed169aaa1c2f89ee89c48282cd83e5a40bd268e281c89257fd803b357b09f91380c38981a3d07b319fa9c05268ac08775ce23638b687

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf35TL09tr75.exe

Filesize
421KB

MD5
a1a8c7e021590c6ccb05a2a54e7d6f12

SHA1
76cabb2806779c8bcaba0f6ca25de05d2a4cda32

SHA256
ffa315cca20806209add23fb058b99380ac07212267bf8fceb265976a24207b8

SHA512
556cb80ba26000eb1426c652b995add13e2f8eb062820d34549317e82e785805b10d19b72942c505e3e1a0c5d985e9e01fcff7ab41124d903b72ce0570acaac2

Download Submit
memory/2032-197-0x0000000004BF0000-0x0000000004C3C000-memory.dmp

Filesize
304KB

Download
memory/2032-30-0x0000000000140000-0x0000000000172000-memory.dmp

Filesize
200KB

Download
memory/2032-196-0x0000000004A70000-0x0000000004AAC000-memory.dmp

Filesize
240KB

Download
memory/2032-193-0x0000000004FA0000-0x00000000055B8000-memory.dmp

Filesize
6.1MB

Download
memory/2032-194-0x0000000004AE0000-0x0000000004BEA000-memory.dmp

Filesize
1.0MB

Download
memory/2032-195-0x0000000004A10000-0x0000000004A22000-memory.dmp

Filesize
72KB

Download
memory/4532-79-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-67-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-37-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-43-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-94-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-91-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-32-0x00000000049E0000-0x0000000004F84000-memory.dmp

Filesize
5.6MB

Download
memory/4532-31-0x0000000002360000-0x00000000023A6000-memory.dmp

Filesize
280KB

Download
memory/4532-27-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4532-29-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4532-87-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-85-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-83-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-81-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-22-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4532-77-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-75-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-73-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-69-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-33-0x0000000004F90000-0x0000000004FD4000-memory.dmp

Filesize
272KB

Download
memory/4532-65-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-63-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-61-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-59-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-57-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-55-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-53-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-49-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-47-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-45-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-41-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-39-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-89-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-71-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-51-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-35-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4532-34-0x0000000004F90000-0x0000000004FCE000-memory.dmp

Filesize
248KB

Download
memory/4724-14-0x00007FF9A45E3000-0x00007FF9A45E5000-memory.dmp

Filesize
8KB

Download
memory/4724-15-0x00000000007D0000-0x00000000007DA000-memory.dmp

Filesize
40KB

Download
memory/4724-16-0x00007FF9A45E3000-0x00007FF9A45E5000-memory.dmp

Filesize
8KB

Download