healer | 009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120.exe
Size

965KB
MD5

7441516920e6c527e228a2b4860f52a3
SHA1

3411362ffd6a11af098b017c6a93fa61ccac6e98
SHA256

009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120
SHA512

c767aaa886dd2a18c88beb564673ba0d8c627cf2d029c031c8ef51e54bfd5ec43dbdabb5eb2744577c2efe7921f3c4c0f838ba1496005d029b1b83f81295af1d
SSDEEP

24576:Jy1ab1FRV02x0H4wMcN7gQrfDcsQlp3PvmO+:8cbDRV02cxN7VksIp3PvmO

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2280-22-0x0000000004A10000-0x0000000004A2A000-memory.dmp	healer
behavioral1/memory/2280-24-0x0000000004BE0000-0x0000000004BF8000-memory.dmp	healer
behavioral1/memory/2280-30-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-52-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-50-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-48-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-46-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-44-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-43-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-40-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-38-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-36-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-34-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-32-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-28-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-26-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer
behavioral1/memory/2280-25-0x0000000004BE0000-0x0000000004BF2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr928007.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr928007.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr928007.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr928007.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr928007.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr928007.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1480-60-0x0000000007140000-0x000000000717C000-memory.dmp	family_redline
behavioral1/memory/1480-61-0x00000000071C0000-0x00000000071FA000-memory.dmp	family_redline
behavioral1/memory/1480-67-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-65-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-63-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-62-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-79-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-96-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-93-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-91-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-90-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-87-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-85-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-83-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-81-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-77-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-75-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-73-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-71-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline
behavioral1/memory/1480-69-0x00000000071C0000-0x00000000071F5000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4516	un883012.exe
3900	un121098.exe
2280	pr928007.exe
1480	qu174099.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr928007.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr928007.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un883012.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un121098.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4780	2280	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un883012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un121098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr928007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu174099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2280	pr928007.exe
2280	pr928007.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	pr928007.exe
Token: SeDebugPrivilege	1480	qu174099.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 4516	1784	009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120.exe	83
PID 1784 wrote to memory of 4516	1784	009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120.exe	83
PID 1784 wrote to memory of 4516	1784	009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120.exe	83
PID 4516 wrote to memory of 3900	4516	un883012.exe	84
PID 4516 wrote to memory of 3900	4516	un883012.exe	84
PID 4516 wrote to memory of 3900	4516	un883012.exe	84
PID 3900 wrote to memory of 2280	3900	un121098.exe	85
PID 3900 wrote to memory of 2280	3900	un121098.exe	85
PID 3900 wrote to memory of 2280	3900	un121098.exe	85
PID 3900 wrote to memory of 1480	3900	un121098.exe	99
PID 3900 wrote to memory of 1480	3900	un121098.exe	99
PID 3900 wrote to memory of 1480	3900	un121098.exe	99

C:\Users\Admin\AppData\Local\Temp\009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120.exe
"C:\Users\Admin\AppData\Local\Temp\009c4d61ba7cd67453c4c2154adfc7de73d4f2f146565067b9cc62f584791120.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un883012.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un883012.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un121098.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un121098.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr928007.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr928007.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2280
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 1064
        5⤵
        Program crash
        
        PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu174099.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu174099.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2280 -ip 2280
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un883012.exe

Filesize
706KB

MD5
273770664e513656c6e28fbd9d8fcd63

SHA1
00ee1dbdee7dca88d32b7497ee4368c7a9ee62c9

SHA256
1ae5ea2c1144e02fc0cf7be45bd9efbcad5df3cd4998a0ae05066add17990b5c

SHA512
fad4c2929762cbdda7c0ebd9a89afec9ec362e67f9bac0173ae8b7eac46855db9a9385225b385542c342a5a3bbd9e3f6c80669aa9f165230acf35350b6b70141

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un121098.exe

Filesize
552KB

MD5
403b460d3a19a5e41f1ed72814c1d870

SHA1
3ecce1f922ccb7bab869fa6e13a0a91fbd272221

SHA256
ae02c8bf7d7fbd027be1371675292ada6f2024d27db7b090483657f0664f98fc

SHA512
1393bfb5c14ae2e371c28749d526a1e4850f0bec151cf4c431f85e9aed7ebd282ba6cb3d626d5ed97d865d23bb3f094a5bf924ab36c84c7f2c6e8ba55b860d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr928007.exe

Filesize
299KB

MD5
cb89136e34c133e81748ac83711b898b

SHA1
2af82165f61aba72ab78d0eca1963020d3209086

SHA256
cdf75215cb55035be3bade8c77950e339a45b98f8892cc24e4d796b0dc2a8b15

SHA512
53bdeb9539556d24d8bcadc6c6164ce5a69e53ef881999c02e5a6e23f4209227a611269d274cbc341e14dff418b905b5e6081ea68cd56377cb9cb5a2a38c7bfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu174099.exe

Filesize
382KB

MD5
9fcc862a61b6b3b7d844e1f31bf0f28a

SHA1
81d8371cc646fe6977a6c86c0e8c14af754f8745

SHA256
d2fdc954464dcdab9ea4b9a3b926f6b692b291919bf672d9225c8aa2ff6528a1

SHA512
0fe802647fac792544dad640f8e1a1d93d759d858af0c627be15eccc5ed04737d4f50ef03cc4843a0416f681e6ca39c3fe52d156df173c6402a228f61f64affa

Download Submit
memory/1480-85-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-854-0x0000000009CB0000-0x000000000A2C8000-memory.dmp

Filesize
6.1MB

Download
memory/1480-858-0x00000000047E0000-0x000000000482C000-memory.dmp

Filesize
304KB

Download
memory/1480-67-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-65-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-69-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-71-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-73-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-75-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-77-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-81-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-856-0x000000000A370000-0x000000000A47A000-memory.dmp

Filesize
1.0MB

Download
memory/1480-83-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-855-0x000000000A350000-0x000000000A362000-memory.dmp

Filesize
72KB

Download
memory/1480-87-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-90-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-91-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-63-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-93-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-96-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-60-0x0000000007140000-0x000000000717C000-memory.dmp

Filesize
240KB

Download
memory/1480-61-0x00000000071C0000-0x00000000071FA000-memory.dmp

Filesize
232KB

Download
memory/1480-79-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/1480-857-0x000000000A4A0000-0x000000000A4DC000-memory.dmp

Filesize
240KB

Download
memory/1480-62-0x00000000071C0000-0x00000000071F5000-memory.dmp

Filesize
212KB

Download
memory/2280-23-0x00000000071B0000-0x0000000007754000-memory.dmp

Filesize
5.6MB

Download
memory/2280-48-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-36-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-34-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-25-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-26-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-28-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-53-0x0000000000400000-0x0000000002BB5000-memory.dmp

Filesize
39.7MB

Download
memory/2280-30-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-24-0x0000000004BE0000-0x0000000004BF8000-memory.dmp

Filesize
96KB

Download
memory/2280-22-0x0000000004A10000-0x0000000004A2A000-memory.dmp

Filesize
104KB

Download
memory/2280-55-0x0000000000400000-0x0000000002BB5000-memory.dmp

Filesize
39.7MB

Download
memory/2280-38-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-40-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-43-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-44-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-46-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-52-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-50-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/2280-32-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download