healer | 3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2.exe
Size

535KB
MD5

fc9a6a09f7d2e091c99abbfc6fe5fa4a
SHA1

cf05dc6e3cd1a02c5006b4f9bc53f0429145d367
SHA256

3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2
SHA512

41f742bed428aa08bf7bb7f74cd7dc3b6609cf70c10d25f89079a9abb9fc06ec8168c6470f7d99861914c889be28be0c46693147e7bdb589b0d92c1fd8fe6c1d
SSDEEP

12288:0MrHy90st+7u8PUNzlQlnuhXKOgNkz9eO/:Dylt+7ZPUNz3P/

Score

10^/10

healer redline rumfa discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rumfa

193.233.20.24:4123

Attributes

auth_value
749d02a6b4ef1fa2ad908e44ec2296dc

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cb8-12.dat	healer
behavioral1/memory/3596-15-0x0000000000770000-0x000000000077A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sw55Bg57uo59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sw55Bg57uo59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sw55Bg57uo59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sw55Bg57uo59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sw55Bg57uo59.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sw55Bg57uo59.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/2780-22-0x0000000002540000-0x0000000002586000-memory.dmp	family_redline
behavioral1/memory/2780-24-0x0000000004BA0000-0x0000000004BE4000-memory.dmp	family_redline
behavioral1/memory/2780-74-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-78-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-88-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-86-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-84-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-82-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-80-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-76-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-72-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-70-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-68-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-66-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-64-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-62-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-60-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-58-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-54-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-52-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-50-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-48-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-46-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-44-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-42-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-38-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-36-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-34-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-32-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-30-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-56-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-40-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-28-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-26-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline
behavioral1/memory/2780-25-0x0000000004BA0000-0x0000000004BDE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2592	vwE4969Az.exe
3596	sw55Bg57uo59.exe
2780	tso08nh20.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	sw55Bg57uo59.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vwE4969Az.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tso08nh20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vwE4969Az.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3596	sw55Bg57uo59.exe
3596	sw55Bg57uo59.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	sw55Bg57uo59.exe
Token: SeDebugPrivilege	2780	tso08nh20.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2592	4868	3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2.exe	84
PID 4868 wrote to memory of 2592	4868	3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2.exe	84
PID 4868 wrote to memory of 2592	4868	3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2.exe	84
PID 2592 wrote to memory of 3596	2592	vwE4969Az.exe	85
PID 2592 wrote to memory of 3596	2592	vwE4969Az.exe	85
PID 2592 wrote to memory of 2780	2592	vwE4969Az.exe	94
PID 2592 wrote to memory of 2780	2592	vwE4969Az.exe	94
PID 2592 wrote to memory of 2780	2592	vwE4969Az.exe	94

C:\Users\Admin\AppData\Local\Temp\3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2.exe
"C:\Users\Admin\AppData\Local\Temp\3138caa0bb237780d7eada68a5196e78803ea1eff662128aa41f1ff32aa8dec2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vwE4969Az.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vwE4969Az.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw55Bg57uo59.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw55Bg57uo59.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3596
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tso08nh20.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tso08nh20.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vwE4969Az.exe

Filesize
391KB

MD5
42b9e858d8ab2f1ed66cc14a5ebaa62e

SHA1
81432cba142af04c28f910cbf5304738967aad0d

SHA256
82a0ff751d6e6d0359a7b2254efed17ba5258d7117fd1bc56257d7075c18796e

SHA512
4d86a3c75b77737cd932d462c370fc5107f57ae8c66db0fda5e608f4c99548552509918d88c662acad0679cec05bb8211c296183687fdce42b7793e865f3ff60

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw55Bg57uo59.exe

Filesize
17KB

MD5
a9072d6a26f411b74303c7c33602bc01

SHA1
f0ccd618f13b915ffb00d3ce7394d75b5548ef61

SHA256
b3244d43e909c03baecfa261350a48fad368eddcd5f274d7318303194963982d

SHA512
39922dd8a138a06a8cb5ed50ad1d1ffeaec40b7bc364c8bd9c39bfb6b1e3ae3222e05d27191713a554fcca12e83d908a6e3518c033de73aa5e65b68377c55569

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tso08nh20.exe

Filesize
302KB

MD5
b0b07df44fd27fecf8a8ed8735a76c78

SHA1
33e2470f3dea8a97ecff3109daed706e174201b4

SHA256
c1628dae076220ce412d7342a5880f545b9ecec4fc819e1ee50d16b483b8e374

SHA512
3e251045447c14c3aa8948ef5a625fd29a87f4ca05330a390e5830fa3cc399d28caa5c03c481b7e97b1d41ef3717872e45bad6609ae3f17ed45fd7be950fd2a7

Download Submit
memory/2780-62-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-22-0x0000000002540000-0x0000000002586000-memory.dmp

Filesize
280KB

Download
memory/2780-935-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Filesize
304KB

Download
memory/2780-58-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-23-0x0000000004C20000-0x00000000051C4000-memory.dmp

Filesize
5.6MB

Download
memory/2780-24-0x0000000004BA0000-0x0000000004BE4000-memory.dmp

Filesize
272KB

Download
memory/2780-74-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-78-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-88-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-86-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-60-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-82-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-54-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-76-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-72-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-70-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-68-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-66-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-64-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-934-0x00000000059C0000-0x00000000059FC000-memory.dmp

Filesize
240KB

Download
memory/2780-84-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-933-0x00000000059A0000-0x00000000059B2000-memory.dmp

Filesize
72KB

Download
memory/2780-80-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-52-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-50-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-48-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-46-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-44-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-42-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-38-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-36-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-34-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-32-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-30-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-56-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-40-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-28-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-26-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-25-0x0000000004BA0000-0x0000000004BDE000-memory.dmp

Filesize
248KB

Download
memory/2780-931-0x00000000051D0000-0x00000000057E8000-memory.dmp

Filesize
6.1MB

Download
memory/2780-932-0x0000000005860000-0x000000000596A000-memory.dmp

Filesize
1.0MB

Download
memory/3596-16-0x00007FFD372E3000-0x00007FFD372E5000-memory.dmp

Filesize
8KB

Download
memory/3596-14-0x00007FFD372E3000-0x00007FFD372E5000-memory.dmp

Filesize
8KB

Download
memory/3596-15-0x0000000000770000-0x000000000077A000-memory.dmp

Filesize
40KB

Download