healer | 81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a.exe
Size

536KB
MD5

4a0ca363d57a0a2f0322781b116a8c67
SHA1

17bd8191359042806f5950370ead48a11a7abf50
SHA256

81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a
SHA512

c2446f868cd01decb397423ea6f678ecab0b13f214911bcc111ca96d1e8128406544a593cc6c87535e80fb6cd15fd8ace60b5bcb68aebeae6d224c19683b20e0
SSDEEP

12288:6MrJy90AxlyKMEq1Eo4LcCwJtx/uKdqC/n7ydYiwko:jydyKMB1MICwJv/uSqi7iwko

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b87-12.dat	healer
behavioral1/memory/4020-15-0x0000000000810000-0x000000000081A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b6472CO.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b6472CO.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b6472CO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b6472CO.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b6472CO.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b6472CO.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/4632-22-0x0000000002680000-0x00000000026C6000-memory.dmp	family_redline
behavioral1/memory/4632-24-0x0000000005060000-0x00000000050A4000-memory.dmp	family_redline
behavioral1/memory/4632-30-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-40-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-88-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-86-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-84-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-82-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-80-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-78-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-76-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-74-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-70-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-68-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-66-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-64-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-62-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-60-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-58-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-56-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-54-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-52-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-48-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-47-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-44-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-42-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-38-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-36-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-34-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-32-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-72-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-50-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-28-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-26-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline
behavioral1/memory/4632-25-0x0000000005060000-0x000000000509E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
2136	nice3960.exe
4020	b6472CO.exe
4632	c99Su29.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b6472CO.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nice3960.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nice3960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c99Su29.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4020	b6472CO.exe
4020	b6472CO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4020	b6472CO.exe
Token: SeDebugPrivilege	4632	c99Su29.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2136	3504	81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a.exe	86
PID 3504 wrote to memory of 2136	3504	81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a.exe	86
PID 3504 wrote to memory of 2136	3504	81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a.exe	86
PID 2136 wrote to memory of 4020	2136	nice3960.exe	87
PID 2136 wrote to memory of 4020	2136	nice3960.exe	87
PID 2136 wrote to memory of 4632	2136	nice3960.exe	97
PID 2136 wrote to memory of 4632	2136	nice3960.exe	97
PID 2136 wrote to memory of 4632	2136	nice3960.exe	97

C:\Users\Admin\AppData\Local\Temp\81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a.exe
"C:\Users\Admin\AppData\Local\Temp\81e74efd9041dd8c6ea971a2f46ad4efb63faa50385dc8a9ccaab543a1b21d0a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice3960.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice3960.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b6472CO.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b6472CO.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c99Su29.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c99Su29.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice3960.exe

Filesize
391KB

MD5
6a35acaafd3ef2a0db72a974673c8809

SHA1
6ff9b97493b3649be7e977c6e01456dad64d4b1a

SHA256
ad844e8977c7f8f1cad935f4312e0404235624a4022f5601bcccc19460dc3735

SHA512
49b9a2f9bdcea4206f1ea5e92c799706ea8f34deb74814c4a9ce7a2cdbe0415b91cc535f1f9e4cc12dd0f06696708b64ef94409576752bf44a9ab0f740568ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b6472CO.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c99Su29.exe

Filesize
308KB

MD5
6fd54cdc940cd51fe90231eca5d4af9b

SHA1
e4e19c019cf0e85571bae053059fcab5f172942f

SHA256
e03ac076ae09a1aed79ef91b576684d9465f3e3c97a2cddb8d5c1302e078263c

SHA512
fee8f6388969d1866dab05183ddb6cec7cd8b9601e6fc7c9c3c5c2350ac1a9d136850837ae49eb9399f4a0f8d34033afae9604d2b0fcc3d87b56b34dccbedd0d

Download Submit
memory/4020-14-0x00007FFDCE7B3000-0x00007FFDCE7B5000-memory.dmp

Filesize
8KB

Download
memory/4020-15-0x0000000000810000-0x000000000081A000-memory.dmp

Filesize
40KB

Download
memory/4020-16-0x00007FFDCE7B3000-0x00007FFDCE7B5000-memory.dmp

Filesize
8KB

Download
memory/4632-64-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-54-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-24-0x0000000005060000-0x00000000050A4000-memory.dmp

Filesize
272KB

Download
memory/4632-30-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-40-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-88-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-86-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-84-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-82-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-80-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-78-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-76-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-74-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-70-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-68-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-66-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-22-0x0000000002680000-0x00000000026C6000-memory.dmp

Filesize
280KB

Download
memory/4632-62-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-60-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-58-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-56-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-23-0x0000000004A70000-0x0000000005014000-memory.dmp

Filesize
5.6MB

Download
memory/4632-52-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-48-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-47-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-44-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-42-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-38-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-36-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-34-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-32-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-72-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-50-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-28-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-26-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-25-0x0000000005060000-0x000000000509E000-memory.dmp

Filesize
248KB

Download
memory/4632-931-0x0000000005100000-0x0000000005718000-memory.dmp

Filesize
6.1MB

Download
memory/4632-932-0x00000000057A0000-0x00000000058AA000-memory.dmp

Filesize
1.0MB

Download
memory/4632-933-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/4632-934-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/4632-935-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download