healer | ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe
Size

931KB
MD5

739e320b0b517cdee3033a018a753609
SHA1

dd952e0bb677569878108c6b3ee76edb997d8836
SHA256

ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1
SHA512

49d0e2d5aee6d1999a069a70644f7d28918241b8186f77e3bfa7e0f26a2e3434f0e643d86899e2e09e6d4c49c45fc3092e4ed98fa6519f7061ecae8b88f5f3d8
SSDEEP

24576:vqGBYOCrAPZg7ov0aR3S8rljm3XWwG9JG:cOCrAd0aR3S8pjmHWw

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2664-33-0x0000000000560000-0x000000000057A000-memory.dmp	healer
behavioral1/memory/2664-34-0x0000000001EF0000-0x0000000001F08000-memory.dmp	healer
behavioral1/memory/2664-40-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-62-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-58-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-56-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-54-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-52-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-50-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-48-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-46-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-44-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-42-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-38-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-60-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-36-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer
behavioral1/memory/2664-35-0x0000000001EF0000-0x0000000001F03000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	180182859.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	180182859.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	180182859.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	180182859.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	180182859.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	180182859.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/564-74-0x0000000004FE0000-0x000000000501C000-memory.dmp	family_redline
behavioral1/memory/564-75-0x0000000005020000-0x000000000505A000-memory.dmp	family_redline
behavioral1/memory/564-77-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-76-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-91-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-89-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-87-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-85-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-83-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-81-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-79-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-93-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-95-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-97-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-99-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-101-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-103-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-105-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-107-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline
behavioral1/memory/564-109-0x0000000005020000-0x0000000005055000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
2688	sj302114.exe
2828	De505526.exe
2664	180182859.exe
564	296902562.exe

Loads dropped DLL 9 IoCs

pid	Process
2640	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe
2688	sj302114.exe
2688	sj302114.exe
2828	De505526.exe
2828	De505526.exe
2664	180182859.exe
2828	De505526.exe
2828	De505526.exe
564	296902562.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	180182859.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	180182859.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sj302114.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	De505526.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	296902562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sj302114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	De505526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	180182859.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	180182859.exe
2664	180182859.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	180182859.exe
Token: SeDebugPrivilege	564	296902562.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2688	2640	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe	30
PID 2640 wrote to memory of 2688	2640	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe	30
PID 2640 wrote to memory of 2688	2640	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe	30
PID 2640 wrote to memory of 2688	2640	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe	30
PID 2640 wrote to memory of 2688	2640	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe	30
PID 2640 wrote to memory of 2688	2640	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe	30
PID 2640 wrote to memory of 2688	2640	ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe	30
PID 2688 wrote to memory of 2828	2688	sj302114.exe	31
PID 2688 wrote to memory of 2828	2688	sj302114.exe	31
PID 2688 wrote to memory of 2828	2688	sj302114.exe	31
PID 2688 wrote to memory of 2828	2688	sj302114.exe	31
PID 2688 wrote to memory of 2828	2688	sj302114.exe	31
PID 2688 wrote to memory of 2828	2688	sj302114.exe	31
PID 2688 wrote to memory of 2828	2688	sj302114.exe	31
PID 2828 wrote to memory of 2664	2828	De505526.exe	32
PID 2828 wrote to memory of 2664	2828	De505526.exe	32
PID 2828 wrote to memory of 2664	2828	De505526.exe	32
PID 2828 wrote to memory of 2664	2828	De505526.exe	32
PID 2828 wrote to memory of 2664	2828	De505526.exe	32
PID 2828 wrote to memory of 2664	2828	De505526.exe	32
PID 2828 wrote to memory of 2664	2828	De505526.exe	32
PID 2828 wrote to memory of 564	2828	De505526.exe	33
PID 2828 wrote to memory of 564	2828	De505526.exe	33
PID 2828 wrote to memory of 564	2828	De505526.exe	33
PID 2828 wrote to memory of 564	2828	De505526.exe	33
PID 2828 wrote to memory of 564	2828	De505526.exe	33
PID 2828 wrote to memory of 564	2828	De505526.exe	33
PID 2828 wrote to memory of 564	2828	De505526.exe	33

C:\Users\Admin\AppData\Local\Temp\ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe
"C:\Users\Admin\AppData\Local\Temp\ceb6aeec4ed9a9b5e836db8f61e251234940b62e015e2f0a3560b95ab79c2ef1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sj302114.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sj302114.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\De505526.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\De505526.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\180182859.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\180182859.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\296902562.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\296902562.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\sj302114.exe

Filesize
665KB

MD5
1b89339e5714582677d4dcc289b081fd

SHA1
d59be5255fbf943386bcaa2f96793e47761ea624

SHA256
8dde625c619bd87dfc04454c01306f5f447f2c451c9c5457973083b180f449c1

SHA512
3879dc92b4b91edf1f179bbc851d9ccb84f34d3f4e848a31247d112f16e36758f0be2b4a44d0feb0575ccea9804dbf467004d4ed7036bacdf28f4de52d3a49b2

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\De505526.exe

Filesize
493KB

MD5
f2e43c1d81413829be9745f60095d724

SHA1
41fda6203558445700dc3f9ec0303f7201e389db

SHA256
1bc42d8df14aaed9657deca56f75308ac6d79610f80034b9e20aabaa7e4a6284

SHA512
4bd325debdae519912a3747f1f5f9e456ee0660d44dcdc7075e1ec8d880a7a83f324879d4f22f2a69abcf28356d73250fb35f1338636f357ec6e153712543d11

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\180182859.exe

Filesize
176KB

MD5
2b71f4b18ac8214a2bff547b6ce2f64f

SHA1
b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

SHA256
f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

SHA512
33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\296902562.exe

Filesize
353KB

MD5
0306a6b4e0b6b15bbbdab72d7053f873

SHA1
a18867ff3ef13a4f941cc604e76c89945e2e87f4

SHA256
006a5607fa5dc80bd224c503063ae5e99c601423a044097f17461884511cd682

SHA512
55b23588af8f4930e949813a8e6cb8c962409b8c30eb766b5b13a2376f4a87ded51565ade961774c49a834ba38146313f1a546942d613135e0bf9373e00a8c6d

Download Submit
memory/564-99-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-93-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-109-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-107-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-105-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-103-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-101-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-77-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-76-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-97-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-95-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-75-0x0000000005020000-0x000000000505A000-memory.dmp

Filesize
232KB

Download
memory/564-79-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-81-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-83-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-85-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-87-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-89-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-91-0x0000000005020000-0x0000000005055000-memory.dmp

Filesize
212KB

Download
memory/564-74-0x0000000004FE0000-0x000000000501C000-memory.dmp

Filesize
240KB

Download
memory/2640-15-0x0000000000400000-0x0000000002C44000-memory.dmp

Filesize
40.3MB

Download
memory/2640-32-0x0000000000400000-0x0000000002C44000-memory.dmp

Filesize
40.3MB

Download
memory/2640-0-0x0000000000230000-0x00000000002F7000-memory.dmp

Filesize
796KB

Download
memory/2664-56-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-35-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-36-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-60-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-38-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-42-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-44-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-46-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-48-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-50-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-52-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-54-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-58-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-62-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-40-0x0000000001EF0000-0x0000000001F03000-memory.dmp

Filesize
76KB

Download
memory/2664-34-0x0000000001EF0000-0x0000000001F08000-memory.dmp

Filesize
96KB

Download
memory/2664-33-0x0000000000560000-0x000000000057A000-memory.dmp

Filesize
104KB

Download