healer | 5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743.exe
Size

702KB
MD5

e3f6f62af5261e22f9cbaa7f6065f11f
SHA1

ab732e4d1f5ac5a4677537dd21a22b5d93721afb
SHA256

5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743
SHA512

b0f2f5799c3f8dced577ffaf1e8637c202017e5335fc8754a4478409fa6e08279e12b4350eaa410828a587eb30a7109437a070e26aeb486148a76ef220b70cb7
SSDEEP

12288:py90hQjI6MQcFlkA4ouslk46fAnyghkYEG2Po9wx87kY0bqwvEtF:pyGuY9yAkZGzweo/hvEtF

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2188-18-0x0000000004AE0000-0x0000000004AFA000-memory.dmp	healer
behavioral1/memory/2188-20-0x0000000007270000-0x0000000007288000-memory.dmp	healer
behavioral1/memory/2188-22-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-48-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-46-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-44-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-42-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-34-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-32-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-30-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-29-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-26-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-24-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-40-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-38-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-36-0x0000000007270000-0x0000000007282000-memory.dmp	healer
behavioral1/memory/2188-21-0x0000000007270000-0x0000000007282000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	78587285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	78587285.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	78587285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	78587285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	78587285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	78587285.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4508-60-0x0000000007120000-0x000000000715C000-memory.dmp	family_redline
behavioral1/memory/4508-61-0x0000000007790000-0x00000000077CA000-memory.dmp	family_redline
behavioral1/memory/4508-87-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-95-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-94-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-92-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-89-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-85-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-83-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-81-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-79-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-77-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-75-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-73-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-71-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-69-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-67-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-65-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-63-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline
behavioral1/memory/4508-62-0x0000000007790000-0x00000000077C5000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
5096	un067629.exe
2188	78587285.exe
4508	rk098018.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	78587285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	78587285.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un067629.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2188	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un067629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78587285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rk098018.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2188	78587285.exe
2188	78587285.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	78587285.exe
Token: SeDebugPrivilege	4508	rk098018.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 5096	1696	5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743.exe	83
PID 1696 wrote to memory of 5096	1696	5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743.exe	83
PID 1696 wrote to memory of 5096	1696	5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743.exe	83
PID 5096 wrote to memory of 2188	5096	un067629.exe	84
PID 5096 wrote to memory of 2188	5096	un067629.exe	84
PID 5096 wrote to memory of 2188	5096	un067629.exe	84
PID 5096 wrote to memory of 4508	5096	un067629.exe	100
PID 5096 wrote to memory of 4508	5096	un067629.exe	100
PID 5096 wrote to memory of 4508	5096	un067629.exe	100

C:\Users\Admin\AppData\Local\Temp\5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743.exe
"C:\Users\Admin\AppData\Local\Temp\5eab63cceca3b2d92296a62612b220299c7be8113e034c9e8777efb442924743.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un067629.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un067629.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78587285.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78587285.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 1048
      4⤵
      Program crash
      PID:2408
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk098018.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk098018.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2188 -ip 2188
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un067629.exe

Filesize
547KB

MD5
e65c204cc370916d5c0c9a286ae6ca7d

SHA1
6f1461888ccbec4640ef6d13271e4c84f4dca589

SHA256
279777de8b6e9a4990f9525d31ab9c28a9ce6101b38596bd6c5c9ce7565a3797

SHA512
a22e92c35cf76b89c379f18e6e20c2e51a10f823bc4c4552aa32f622786b8ade15fdbdf6210b7a98a7052ded1e2f1e04ae24996233221ef31e878a94568baaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78587285.exe

Filesize
269KB

MD5
012427f096f3122209a3f4cff9613a95

SHA1
a550eb5bc3e5c865040d99b11fb8260add79ecf0

SHA256
cf95dab464982e5b8f2921f295e60cec84c08242f9b17302c2666c1848a75eaa

SHA512
c34a4520c07a82597f3b67e46873e47794d471044f78878c0dfa639f8d457f3683f4662dd44dda6e75135fca6336551e831282240cd8e09ef6f3f3afe8bf76f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk098018.exe

Filesize
353KB

MD5
0b960b64772d803f8e213bf6c0c4fa48

SHA1
4dfe9516362f36b39a478b21f8cd319d4470d0f5

SHA256
78b49a983a39e27333a856351dfaa172aead25cdeccfa57d14dbd436dab603fb

SHA512
c54bb8f1c05f6a4cb3a0d8af22beec6e98c8a053d42edd6bf68e487f871d02303de87dc730e81a7d153db5e9109927d5e25c89574b0b7fe88fd6d439cafe2446

Download Submit
memory/2188-15-0x0000000002D80000-0x0000000002E80000-memory.dmp

Filesize
1024KB

Download
memory/2188-16-0x0000000002BA0000-0x0000000002BCD000-memory.dmp

Filesize
180KB

Download
memory/2188-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2188-18-0x0000000004AE0000-0x0000000004AFA000-memory.dmp

Filesize
104KB

Download
memory/2188-19-0x0000000007300000-0x00000000078A4000-memory.dmp

Filesize
5.6MB

Download
memory/2188-20-0x0000000007270000-0x0000000007288000-memory.dmp

Filesize
96KB

Download
memory/2188-22-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-48-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-46-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-44-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-42-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-34-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-32-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-30-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-29-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-26-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-24-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-40-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-38-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-36-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-21-0x0000000007270000-0x0000000007282000-memory.dmp

Filesize
72KB

Download
memory/2188-49-0x0000000002D80000-0x0000000002E80000-memory.dmp

Filesize
1024KB

Download
memory/2188-50-0x0000000002BA0000-0x0000000002BCD000-memory.dmp

Filesize
180KB

Download
memory/2188-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2188-51-0x0000000000400000-0x0000000002B9E000-memory.dmp

Filesize
39.6MB

Download
memory/2188-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2188-54-0x0000000000400000-0x0000000002B9E000-memory.dmp

Filesize
39.6MB

Download
memory/4508-60-0x0000000007120000-0x000000000715C000-memory.dmp

Filesize
240KB

Download
memory/4508-61-0x0000000007790000-0x00000000077CA000-memory.dmp

Filesize
232KB

Download
memory/4508-87-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-95-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-94-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-92-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-89-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-85-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-83-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-81-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-79-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-77-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-75-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-73-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-71-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-69-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-67-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-65-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-63-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-62-0x0000000007790000-0x00000000077C5000-memory.dmp

Filesize
212KB

Download
memory/4508-855-0x000000000A340000-0x000000000A352000-memory.dmp

Filesize
72KB

Download
memory/4508-856-0x000000000A360000-0x000000000A46A000-memory.dmp

Filesize
1.0MB

Download
memory/4508-854-0x0000000009C90000-0x000000000A2A8000-memory.dmp

Filesize
6.1MB

Download
memory/4508-857-0x000000000A480000-0x000000000A4BC000-memory.dmp

Filesize
240KB

Download
memory/4508-858-0x0000000004AE0000-0x0000000004B2C000-memory.dmp

Filesize
304KB

Download