healer | f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113.exe
Size

828KB
MD5

9c0edc080c6306aa5320908f9b1cee8c
SHA1

e7ba505eae0d9c5d766fb243ee605a774f8fee79
SHA256

f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113
SHA512

e510a5eb88ce55d0ee696e340964848b8e3617a96016230ba85cdf60ea5956d2c6cbd5d5fa82dde51ec163012eb374f8abf329f6940385edaf0a57348114491c
SSDEEP

24576:nyayp8rEGNSG5OGvMeIG3V79Tqz1Nm7/BW:ychOuIGlhTqRNm7/

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cae-20.dat	healer
behavioral1/memory/4388-22-0x0000000000720000-0x000000000072A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it063808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it063808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it063808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it063808.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it063808.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it063808.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/2376-29-0x0000000004BF0000-0x0000000004C2C000-memory.dmp	family_redline
behavioral1/memory/2376-31-0x0000000004C70000-0x0000000004CAA000-memory.dmp	family_redline
behavioral1/memory/2376-37-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-63-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-95-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-94-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-91-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-89-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-87-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-85-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-83-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-81-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-79-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-77-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-75-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-73-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-69-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-67-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-65-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-61-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-59-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-58-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-55-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-53-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-51-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-49-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-47-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-45-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-43-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-41-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-39-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-35-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-71-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-33-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline
behavioral1/memory/2376-32-0x0000000004C70000-0x0000000004CA5000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
2564	ziWN5416.exe
3644	zioo5633.exe
4388	it063808.exe
2376	jr707169.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it063808.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziWN5416.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zioo5633.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziWN5416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zioo5633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jr707169.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4388	it063808.exe
4388	it063808.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	it063808.exe
Token: SeDebugPrivilege	2376	jr707169.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2564	5068	f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113.exe	83
PID 5068 wrote to memory of 2564	5068	f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113.exe	83
PID 5068 wrote to memory of 2564	5068	f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113.exe	83
PID 2564 wrote to memory of 3644	2564	ziWN5416.exe	84
PID 2564 wrote to memory of 3644	2564	ziWN5416.exe	84
PID 2564 wrote to memory of 3644	2564	ziWN5416.exe	84
PID 3644 wrote to memory of 4388	3644	zioo5633.exe	86
PID 3644 wrote to memory of 4388	3644	zioo5633.exe	86
PID 3644 wrote to memory of 2376	3644	zioo5633.exe	97
PID 3644 wrote to memory of 2376	3644	zioo5633.exe	97
PID 3644 wrote to memory of 2376	3644	zioo5633.exe	97

C:\Users\Admin\AppData\Local\Temp\f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113.exe
"C:\Users\Admin\AppData\Local\Temp\f496a08bb34ec5d3202fa0300219835ab1a93100e06e2b3b5404011e1eca6113.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN5416.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN5416.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zioo5633.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zioo5633.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it063808.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it063808.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr707169.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr707169.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWN5416.exe

Filesize
569KB

MD5
a59c8ad923c48327263a783f01d30cdc

SHA1
ec4cbfaefc0f04ce4fa33aaadb819884502046a1

SHA256
41992174d820c06cfb638eb12ddd7ebd7f4530051e2da72e389aa4270d3cf9ac

SHA512
0db732e6ff20b6358c543fb31227a755660368f611e898a652c9a55621cfea602d89d39cc9822c83dfe2035a08e313d71e50414b967cabf18b5288160d6c0e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zioo5633.exe

Filesize
415KB

MD5
d9b4c8f4a8987fc6ee70275a41c6360e

SHA1
6548f6243b8c0a77d292c7ba5811f64347a064c7

SHA256
eb919e63d155f0c2d0f1f6d8fbca86d14f4e5d2505e4c7b63e4f172958a9f9a2

SHA512
fe56ddd73171daf3d5be09d55e1f7954df59f3fbea6f44c65da91932e790abfc129c413eea03c68b022581f29fc4adf3126a0238294d62248c3f9d430603bd8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it063808.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr707169.exe

Filesize
382KB

MD5
da7d3be70ff5dd2c75f888196ba1a940

SHA1
204e0ae256bfa1ea941867a97411206989f2f8a6

SHA256
b824a6cb436f619d1cc567c6517187cc0c91e438fc38982849e21339bb7d8115

SHA512
bbc9a5637ad0359eed8ab6d00cf3ff46352b6363ea1e8944203a005d2a9cd1f83f055197cf0d9830b877d7f5b06c462d815ddffb450f893d8d362292500904a6

Download Submit
memory/2376-69-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-29-0x0000000004BF0000-0x0000000004C2C000-memory.dmp

Filesize
240KB

Download
memory/2376-828-0x0000000004910000-0x000000000495C000-memory.dmp

Filesize
304KB

Download
memory/2376-67-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-30-0x0000000007500000-0x0000000007AA4000-memory.dmp

Filesize
5.6MB

Download
memory/2376-31-0x0000000004C70000-0x0000000004CAA000-memory.dmp

Filesize
232KB

Download
memory/2376-37-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-63-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-95-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-94-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-827-0x000000000A620000-0x000000000A65C000-memory.dmp

Filesize
240KB

Download
memory/2376-89-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-65-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-85-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-83-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-81-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-79-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-77-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-75-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-73-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-91-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-826-0x000000000A4B0000-0x000000000A5BA000-memory.dmp

Filesize
1.0MB

Download
memory/2376-87-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-61-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-59-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-58-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-55-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-53-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-51-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-49-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-47-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-45-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-43-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-41-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-39-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-35-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-71-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-33-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-32-0x0000000004C70000-0x0000000004CA5000-memory.dmp

Filesize
212KB

Download
memory/2376-824-0x0000000009E30000-0x000000000A448000-memory.dmp

Filesize
6.1MB

Download
memory/2376-825-0x000000000A490000-0x000000000A4A2000-memory.dmp

Filesize
72KB

Download
memory/4388-23-0x00007FFBBD023000-0x00007FFBBD025000-memory.dmp

Filesize
8KB

Download
memory/4388-21-0x00007FFBBD023000-0x00007FFBBD025000-memory.dmp

Filesize
8KB

Download
memory/4388-22-0x0000000000720000-0x000000000072A000-memory.dmp

Filesize
40KB

Download