healer | 07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175.exe
Size

546KB
MD5

5b8309040f3c476bc9dc9557f6c6f4c3
SHA1

40af298ecf9a25fd1b19e8dca11c4e69e9ad74ea
SHA256

07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175
SHA512

e2d6d8501437ae1c39728fb37345e247b32671c0da82f9fa584519a597e3f3fd4c3bf116b7a4e91e57e2962a2261b3f4f79b8db5c83e526f90cea1d228a9d8aa
SSDEEP

12288:gMrSy906lw7GGBmyAKfld3PzxwtlwLcUvMLKzcuZ8yYWzl4:Cyp5yAYLykHvMLHubPB4

Score

10^/10

healer redline down discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c67-12.dat	healer
behavioral1/memory/2024-15-0x0000000000660000-0x000000000066A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6353.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6353.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6353.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6353.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6353.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6353.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/4244-22-0x0000000002600000-0x0000000002646000-memory.dmp	family_redline
behavioral1/memory/4244-24-0x0000000002790000-0x00000000027D4000-memory.dmp	family_redline
behavioral1/memory/4244-28-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-26-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-25-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-44-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-88-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-86-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-84-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-82-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-78-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-77-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-74-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-72-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-70-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-68-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-66-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-64-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-62-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-60-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-58-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-56-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-54-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-52-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-48-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-47-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-42-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-40-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-39-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-36-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-34-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-32-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-30-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-80-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline
behavioral1/memory/4244-50-0x0000000002790000-0x00000000027CE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2268	unio9620.exe
2024	pro6353.exe
4244	qu4906.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6353.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	unio9620.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unio9620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu4906.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2024	pro6353.exe
2024	pro6353.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	pro6353.exe
Token: SeDebugPrivilege	4244	qu4906.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 2268	3652	07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175.exe	83
PID 3652 wrote to memory of 2268	3652	07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175.exe	83
PID 3652 wrote to memory of 2268	3652	07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175.exe	83
PID 2268 wrote to memory of 2024	2268	unio9620.exe	84
PID 2268 wrote to memory of 2024	2268	unio9620.exe	84
PID 2268 wrote to memory of 4244	2268	unio9620.exe	97
PID 2268 wrote to memory of 4244	2268	unio9620.exe	97
PID 2268 wrote to memory of 4244	2268	unio9620.exe	97

C:\Users\Admin\AppData\Local\Temp\07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175.exe
"C:\Users\Admin\AppData\Local\Temp\07ebcf6d1d5ed48c4b70c5dce385c336b2c7efe678cffae2d1a811d18b543175.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9620.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9620.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6353.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6353.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4906.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4906.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9620.exe

Filesize
404KB

MD5
e553409973df6a50db1dea5b50b5e755

SHA1
4273b04753a4a331638a2baeebf5e37e6c9be053

SHA256
d87c6ee62bb9c2d4b8e521dae5e6a07d9b3d8d7ff27882ddb7447cf3c51d8c64

SHA512
4437eb24a899259245df1a4886f8dfcbd6dc8a2607d580019b6d94bb7704486f50d3055f62b64c9f5c77d303f3e084b5b9398527f25603caab12974e74874cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6353.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4906.exe

Filesize
358KB

MD5
fe38edb79da2f4f64f1ac01797572fd7

SHA1
74cd02692b1b6fb64b44e9559ae918862622f843

SHA256
6189cc27e40b958bb32d614a014d4aa67d90f136a49cc7a8fac4cfc5f174b47e

SHA512
6629927bd82e33b77fb2d3bc11c18d652bb5b110248f0cc07875d48726fae11a6734fdc5b40a182ac4159ee1e685e3dc22ca4650fa09b36222f2fb4da58ef386

Download Submit
memory/2024-14-0x00007FFBC4423000-0x00007FFBC4425000-memory.dmp

Filesize
8KB

Download
memory/2024-15-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/2024-16-0x00007FFBC4423000-0x00007FFBC4425000-memory.dmp

Filesize
8KB

Download
memory/4244-68-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-58-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-24-0x0000000002790000-0x00000000027D4000-memory.dmp

Filesize
272KB

Download
memory/4244-28-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-26-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-25-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-44-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-88-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-86-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-84-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-82-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-78-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-77-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-74-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-72-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-70-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-22-0x0000000002600000-0x0000000002646000-memory.dmp

Filesize
280KB

Download
memory/4244-66-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-64-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-62-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-60-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-23-0x0000000004E20000-0x00000000053C4000-memory.dmp

Filesize
5.6MB

Download
memory/4244-56-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-54-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-52-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-48-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-47-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-42-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-40-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-39-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-36-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-34-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-32-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-30-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-80-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-50-0x0000000002790000-0x00000000027CE000-memory.dmp

Filesize
248KB

Download
memory/4244-931-0x00000000053D0000-0x00000000059E8000-memory.dmp

Filesize
6.1MB

Download
memory/4244-932-0x00000000059F0000-0x0000000005AFA000-memory.dmp

Filesize
1.0MB

Download
memory/4244-933-0x0000000005B30000-0x0000000005B42000-memory.dmp

Filesize
72KB

Download
memory/4244-934-0x0000000005B50000-0x0000000005B8C000-memory.dmp

Filesize
240KB

Download
memory/4244-935-0x0000000005CA0000-0x0000000005CEC000-memory.dmp

Filesize
304KB

Download