healer | 4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3.exe
Size

694KB
MD5

7c1eda7a16815c80c4f5605ed16d5062
SHA1

7f9a74caa1019f48a72f9a1fa67983affe833ce8
SHA256

4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3
SHA512

fee21af416c55c9009385cdcc60f53363c51fa2bdec14252420c9cbc76cef0daa5256ca25f7120c843e360ee68eb5ac1b2af3474a38ec96b52185da6892f5e48
SSDEEP

12288:ky90bJjlHjqgC/r1OX5tn1cOyUm5Krzv6ILfZHVN375/eWEvf1gUzm:kymJjlDnC/r1OXf1n4azTDLN375GW49i

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4552-17-0x0000000007200000-0x000000000721A000-memory.dmp	healer
behavioral1/memory/4552-19-0x0000000007270000-0x0000000007288000-memory.dmp	healer
behavioral1/memory/4552-38-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-48-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-46-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-44-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-42-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-40-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-36-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-34-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-32-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-30-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-28-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-26-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-22-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-21-0x0000000007270000-0x0000000007283000-memory.dmp	healer
behavioral1/memory/4552-24-0x0000000007270000-0x0000000007283000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	11114566.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	11114566.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	11114566.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	11114566.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	11114566.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	11114566.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/2312-59-0x0000000007130000-0x000000000716C000-memory.dmp	family_redline
behavioral1/memory/2312-61-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-60-0x00000000071B0000-0x00000000071EA000-memory.dmp	family_redline
behavioral1/memory/2312-95-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-92-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-91-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-88-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-86-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-85-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-82-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-81-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-78-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-76-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-75-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-72-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-71-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-68-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-66-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-64-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline
behavioral1/memory/2312-62-0x00000000071B0000-0x00000000071E5000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3480	un754553.exe
4552	11114566.exe
2312	rk936499.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	11114566.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	11114566.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un754553.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
372	4552	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un754553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11114566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rk936499.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	11114566.exe
4552	11114566.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	11114566.exe
Token: SeDebugPrivilege	2312	rk936499.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3480	1960	4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3.exe	83
PID 1960 wrote to memory of 3480	1960	4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3.exe	83
PID 1960 wrote to memory of 3480	1960	4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3.exe	83
PID 3480 wrote to memory of 4552	3480	un754553.exe	84
PID 3480 wrote to memory of 4552	3480	un754553.exe	84
PID 3480 wrote to memory of 4552	3480	un754553.exe	84
PID 3480 wrote to memory of 2312	3480	un754553.exe	96
PID 3480 wrote to memory of 2312	3480	un754553.exe	96
PID 3480 wrote to memory of 2312	3480	un754553.exe	96

C:\Users\Admin\AppData\Local\Temp\4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3.exe
"C:\Users\Admin\AppData\Local\Temp\4bc85699c990cd71e0897a1ea80e8448a5dc67caa912d9696fc5942758649ab3.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un754553.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un754553.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11114566.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11114566.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1084
      4⤵
      Program crash
      PID:372
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk936499.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk936499.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4552 -ip 4552
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un754553.exe

Filesize
540KB

MD5
2560da4ff74c43c539153ab2010a8208

SHA1
d1c3c3d0235f5adc5a2b718f4a7ce21cc9a13100

SHA256
fa7db859149884d48870d432be6cf39a0319198241000cd40ce10aa39ec96b54

SHA512
220d978b9520cd71ff2b6b9395cb816b03e51999f5b67adb8cbc8971c5b9e14931c9957d125bf3a64e57214fe49e36f178fcc4839c5846ee92dc2ec46cae98ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11114566.exe

Filesize
258KB

MD5
7137bb00ded6d14c1bb28c5f23c66158

SHA1
56202b7e06b6a6161e403e879bce98c3cdc0e37d

SHA256
743730407697003ce9ab533101c526c052dd6f3b6e03784f2497898400dda386

SHA512
a7df18b1f2230fb1476639c3870a97ebc71f2ae27aa2b3559496d787338c6c5c1c5b7270bdf9e5190723379df9889a5eaf13c9c803bd9678c2b1baac18270350

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk936499.exe

Filesize
341KB

MD5
80182e698d314d2be062fb18dd6ab043

SHA1
cb7023553aaf434dfecd13e5e726bc1798a5d719

SHA256
2d98019db6eca9854dac87a0a68f379f27e48fcb247de3e099feb880b7ac3f7d

SHA512
ecbd7d10d56996373587e3a4593ee44cc285fd29a7a3a5a3173e5858fc75ef52632b840d99a4dc199fafef020442f577a14b7c6439edcd1ff99074e1614fb5e3

Download Submit
memory/2312-82-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-856-0x000000000A470000-0x000000000A4AC000-memory.dmp

Filesize
240KB

Download
memory/2312-68-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-71-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-72-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-857-0x00000000049C0000-0x0000000004A0C000-memory.dmp

Filesize
304KB

Download
memory/2312-75-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-76-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-78-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-81-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-64-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-59-0x0000000007130000-0x000000000716C000-memory.dmp

Filesize
240KB

Download
memory/2312-85-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-66-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-853-0x0000000009D00000-0x000000000A318000-memory.dmp

Filesize
6.1MB

Download
memory/2312-855-0x000000000A350000-0x000000000A45A000-memory.dmp

Filesize
1.0MB

Download
memory/2312-854-0x000000000A330000-0x000000000A342000-memory.dmp

Filesize
72KB

Download
memory/2312-86-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-88-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-91-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-92-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-95-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-60-0x00000000071B0000-0x00000000071EA000-memory.dmp

Filesize
232KB

Download
memory/2312-61-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/2312-62-0x00000000071B0000-0x00000000071E5000-memory.dmp

Filesize
212KB

Download
memory/4552-40-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4552-53-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/4552-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4552-49-0x0000000002F60000-0x0000000003060000-memory.dmp

Filesize
1024KB

Download
memory/4552-24-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-21-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-22-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-26-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-28-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-30-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-32-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-34-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-36-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-42-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-44-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-46-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-48-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-38-0x0000000007270000-0x0000000007283000-memory.dmp

Filesize
76KB

Download
memory/4552-19-0x0000000007270000-0x0000000007288000-memory.dmp

Filesize
96KB

Download
memory/4552-20-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/4552-18-0x00000000073B0000-0x0000000007954000-memory.dmp

Filesize
5.6MB

Download
memory/4552-17-0x0000000007200000-0x000000000721A000-memory.dmp

Filesize
104KB

Download
memory/4552-15-0x0000000002F60000-0x0000000003060000-memory.dmp

Filesize
1024KB

Download
memory/4552-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download