healer | 2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed.exe
Size

1.0MB
MD5

53cfa62e677e878a5adfe9aefb6c9544
SHA1

5dc3646277c581182790c8b806a2a44630c82827
SHA256

2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed
SHA512

84ade5513979a4cf5e5225d99cc8394d5c2e4432fb7fe59dff2693099fc66a7fd6bc3e0cdaa8f4933adbb1089fa6a8b810effaef615dec236bc15a95d353c6ad
SSDEEP

24576:nyL4ubwS0TPxPmDaXebCzVDFikEail3PnRbPVSBS8Li4p8QR6X:ysFS0TPxuDseb0VDkNaO3vRbPRxA8Q

Score

10^/10

healer redline ramon discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

ramon

193.233.20.23:4123

Attributes

auth_value
3197576965d9513f115338c233015b40

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023caa-26.dat	healer
behavioral1/memory/2108-28-0x0000000000990000-0x000000000099A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	baM23Os.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	baM23Os.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	baM23Os.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	baM23Os.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	baM23Os.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	baM23Os.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/4228-34-0x0000000002510000-0x0000000002556000-memory.dmp	family_redline
behavioral1/memory/4228-36-0x0000000002610000-0x0000000002654000-memory.dmp	family_redline
behavioral1/memory/4228-42-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-54-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-100-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-99-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-96-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-94-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-92-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-90-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-88-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-86-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-85-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-82-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-81-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-78-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-76-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-75-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-72-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-70-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-68-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-66-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-64-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-62-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-60-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-58-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-52-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-50-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-48-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-46-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-44-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-56-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-40-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-38-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline
behavioral1/memory/4228-37-0x0000000002610000-0x000000000264E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
1216	pIo52Tt.exe
3944	pwc69dN.exe
3460	pDw80SS.exe
2108	baM23Os.exe
4228	cfc48rs28.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	baM23Os.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	pwc69dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	pDw80SS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	pIo52Tt.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfc48rs28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pIo52Tt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pwc69dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pDw80SS.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2108	baM23Os.exe
2108	baM23Os.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	baM23Os.exe
Token: SeDebugPrivilege	4228	cfc48rs28.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1216	2024	2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed.exe	84
PID 2024 wrote to memory of 1216	2024	2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed.exe	84
PID 2024 wrote to memory of 1216	2024	2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed.exe	84
PID 1216 wrote to memory of 3944	1216	pIo52Tt.exe	85
PID 1216 wrote to memory of 3944	1216	pIo52Tt.exe	85
PID 1216 wrote to memory of 3944	1216	pIo52Tt.exe	85
PID 3944 wrote to memory of 3460	3944	pwc69dN.exe	87
PID 3944 wrote to memory of 3460	3944	pwc69dN.exe	87
PID 3944 wrote to memory of 3460	3944	pwc69dN.exe	87
PID 3460 wrote to memory of 2108	3460	pDw80SS.exe	88
PID 3460 wrote to memory of 2108	3460	pDw80SS.exe	88
PID 3460 wrote to memory of 4228	3460	pDw80SS.exe	99
PID 3460 wrote to memory of 4228	3460	pDw80SS.exe	99
PID 3460 wrote to memory of 4228	3460	pDw80SS.exe	99

C:\Users\Admin\AppData\Local\Temp\2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed.exe
"C:\Users\Admin\AppData\Local\Temp\2171c83a47511681c9074ceed5dd1794db372549a5ee0138fd59e84179fcdeed.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pIo52Tt.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pIo52Tt.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pwc69dN.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pwc69dN.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pDw80SS.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pDw80SS.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\baM23Os.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\baM23Os.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cfc48rs28.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cfc48rs28.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pIo52Tt.exe

Filesize
884KB

MD5
ca788ed02dfb0ad5db462a63af78078d

SHA1
76f27053a2142ad7c6de1b3083c6f0328b9fed91

SHA256
b2c33c8c7311b30958b555dd11091536ae9258fa69e48d4ee95aa90e1952e94b

SHA512
40fc28220cca42d6a3ccee1a6d80a17a793694b56f467ab5e43ef70953e6cb61df972c2f98e60934cebc07a8f2355abe05f0f027cc8ca720f638456f2ffc9fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pwc69dN.exe

Filesize
661KB

MD5
b7fdb43c417df684f4c313c15bba62f9

SHA1
9db1accf4edbbed8ebd830a0d7566be0629e7e57

SHA256
6efa54bbb4d7c61724c91b5fa437a2df8bec60ab696714392435868657086f43

SHA512
16e072dad4a8176fa3a11ac41155eac04551bca15977641dff0bcaf31921411d0aecc265c9aa7f08d7327b5f1a1e3216b4b91ad0d550a8e5e1b543ba66ddc0e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pDw80SS.exe

Filesize
388KB

MD5
e39c5e251a608d301ce0c2bc7e796d86

SHA1
8e0e2e051337b0e90830615941ac0ea005d64506

SHA256
1164f029f4e4a01ab8dd47c9067102bd073f0d9cff8e888ffc02f3d183a4def0

SHA512
e368fd6fe01344b29ab3bef7c3a342a420fd5513abd9965cd843140a1bd5a8ca605942f4e5c414e43ecb58484700395f9a9079984add8cd59b631e53f799fe3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\baM23Os.exe

Filesize
11KB

MD5
daa8dbddbca6d077a7fc234496923cf1

SHA1
4df2b6327e8e75ed71c0e3055c9d17a043ff6b65

SHA256
17528baacf916fa9379bb2df7a9cb98e87f6759a74a3dccd565a04c671d67b56

SHA512
b8c878f507ad26dfee4caa5f37ad8f6e909ce5354f9aa4df8535fcdeb75e654afbd179ca2c16eedfc4c2ba9d4de13b58e1fdb23424a72c9da893f6b1f5f4890a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cfc48rs28.exe

Filesize
306KB

MD5
39e68ec5c671803bea570c9c8149ecf5

SHA1
93cb8d7be2e1aa555e5541d1d946271d32cf20ba

SHA256
7359387553ff87aa91886a0e850132f5024f913e22cc8eb764d401fcdb0d58f5

SHA512
5ce2317044a61712de25b803c7bb51a6a6aba6c9606cbaa2b5b340960a59baf98b5041ddc417924fec3f03a9543a8442eeb465a28c1986458e80e292568d9ada

Download Submit
memory/2108-28-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download
memory/4228-78-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-68-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-36-0x0000000002610000-0x0000000002654000-memory.dmp

Filesize
272KB

Download
memory/4228-42-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-54-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-100-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-99-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-96-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-94-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-92-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-90-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-88-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-86-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-85-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-82-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-81-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-34-0x0000000002510000-0x0000000002556000-memory.dmp

Filesize
280KB

Download
memory/4228-76-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-75-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-72-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-70-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-35-0x0000000004C20000-0x00000000051C4000-memory.dmp

Filesize
5.6MB

Download
memory/4228-66-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-64-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-62-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-60-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-58-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-52-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-50-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-48-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-46-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-44-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-56-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-40-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-38-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-37-0x0000000002610000-0x000000000264E000-memory.dmp

Filesize
248KB

Download
memory/4228-943-0x00000000051D0000-0x00000000057E8000-memory.dmp

Filesize
6.1MB

Download
memory/4228-944-0x0000000005860000-0x000000000596A000-memory.dmp

Filesize
1.0MB

Download
memory/4228-945-0x00000000059A0000-0x00000000059B2000-memory.dmp

Filesize
72KB

Download
memory/4228-946-0x00000000059C0000-0x00000000059FC000-memory.dmp

Filesize
240KB

Download
memory/4228-947-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Filesize
304KB

Download