healer | 15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b.exe
Size

530KB
MD5

03aa0366d2ef6e0565c643b83ca3e14f
SHA1

38c3263358a8f5f20fdffcc1f70745554e1edee7
SHA256

15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b
SHA512

6929b5d3242d9ecca9e2e4e885e74db8756c6d6d394fc5a6253ed2c4d81788e9ccfd0cff6b5311566dd7a40632c154b770c2bae619f68a050f36c407a9163f6a
SSDEEP

12288:ZMr5y90YUZ8MVV1tXgH85k3tNEvizKNSM2IyacQZmk:UyLUZ1VzBgc5shWNII3cdk

Score

10^/10

healer redline fud discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

fud

193.233.20.27:4123

Attributes

auth_value
cddc991efd6918ad5321d80dac884b40

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0010000000023aa7-13.dat	healer
behavioral1/memory/1572-15-0x0000000000BE0000-0x0000000000BEA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sf24PV68it73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	sf24PV68it73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sf24PV68it73.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sf24PV68it73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sf24PV68it73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	sf24PV68it73.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/2028-22-0x0000000002360000-0x00000000023A6000-memory.dmp	family_redline
behavioral1/memory/2028-24-0x0000000002710000-0x0000000002754000-memory.dmp	family_redline
behavioral1/memory/2028-74-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-88-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-86-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-84-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-82-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-80-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-78-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-76-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-72-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-70-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-68-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-66-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-64-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-62-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-61-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-56-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-54-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-53-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-48-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-46-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-45-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-42-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-41-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-38-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-36-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-32-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-30-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-26-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-58-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-50-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-34-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-28-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline
behavioral1/memory/2028-25-0x0000000002710000-0x000000000274E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1260	vhVs4319YQ.exe
1572	sf24PV68it73.exe
2028	tf57oR42ap02.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	sf24PV68it73.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vhVs4319YQ.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vhVs4319YQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tf57oR42ap02.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1572	sf24PV68it73.exe
1572	sf24PV68it73.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	sf24PV68it73.exe
Token: SeDebugPrivilege	2028	tf57oR42ap02.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1260	2592	15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b.exe	84
PID 2592 wrote to memory of 1260	2592	15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b.exe	84
PID 2592 wrote to memory of 1260	2592	15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b.exe	84
PID 1260 wrote to memory of 1572	1260	vhVs4319YQ.exe	85
PID 1260 wrote to memory of 1572	1260	vhVs4319YQ.exe	85
PID 1260 wrote to memory of 2028	1260	vhVs4319YQ.exe	95
PID 1260 wrote to memory of 2028	1260	vhVs4319YQ.exe	95
PID 1260 wrote to memory of 2028	1260	vhVs4319YQ.exe	95

C:\Users\Admin\AppData\Local\Temp\15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b.exe
"C:\Users\Admin\AppData\Local\Temp\15d2f517a81ed879dee232d80451b97d40fcda9b4b660853a0508006bc31ae5b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhVs4319YQ.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhVs4319YQ.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf24PV68it73.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf24PV68it73.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf57oR42ap02.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf57oR42ap02.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhVs4319YQ.exe

Filesize
386KB

MD5
e2864fc1d65eca88f0dea2482610ae69

SHA1
c1381df1eca29c1028846fc82de1110a9a33f774

SHA256
7277987b8a4b95a6dfebc6c8ebc4052f5b8b4a9f78f15724a4a6b56bf291a7a7

SHA512
da5d3db8c0fe48c9610a444dacc5a72df5f0ca7396d6c3b607bf6f484386c1091bdf084490b468bf37de479d5028e060313fdab0165321d0d6fe60f34ec01779

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf24PV68it73.exe

Filesize
11KB

MD5
0c33b00665dc7cbe52f876428288046e

SHA1
f2718ec4c334823c84baf7d0f81dc8551135bf9d

SHA256
c3a817f42b828e902ba1969ac794af8bd77fe39252c39fcf3a08e87c0dfcba3b

SHA512
a080f4c8089a52f34a481a8f868f031c3aa86600928d7b64bd0bdf535c7f2c9efd7591d1c2a3660de8eb0a38549837d7e8c0dde033eae7d1616d36046afe2791

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf57oR42ap02.exe

Filesize
293KB

MD5
dc46cb34b733eb4be1b44f9cc7c7d6e1

SHA1
08972fbd4db0346b9a5aa7651f1948e212cbbe6f

SHA256
79e234cc24dfe4d038a4e8eeb3f6f993d71c4c7823ae4a7abfc0e149df57103e

SHA512
8cf36db8e149189b1262d31be684329159f3fd41b2bbd1a23a91413d821eb7d0b825a467b56e508d921d1464fcaa183424dc05ebe45280dfc389bec65ba1f1b4

Download Submit
memory/1572-14-0x00007FFEF0303000-0x00007FFEF0305000-memory.dmp

Filesize
8KB

Download
memory/1572-15-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

Filesize
40KB

Download
memory/1572-16-0x00007FFEF0303000-0x00007FFEF0305000-memory.dmp

Filesize
8KB

Download
memory/2028-62-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-48-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-24-0x0000000002710000-0x0000000002754000-memory.dmp

Filesize
272KB

Download
memory/2028-74-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-88-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-86-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-84-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-82-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-80-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-78-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-76-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-72-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-70-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-68-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-66-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-64-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-22-0x0000000002360000-0x00000000023A6000-memory.dmp

Filesize
280KB

Download
memory/2028-61-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-56-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-54-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-53-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-23-0x0000000004E60000-0x0000000005404000-memory.dmp

Filesize
5.6MB

Download
memory/2028-46-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-45-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-42-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-41-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-38-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-36-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-32-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-30-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-26-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-58-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-50-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-34-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-28-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-25-0x0000000002710000-0x000000000274E000-memory.dmp

Filesize
248KB

Download
memory/2028-931-0x0000000005410000-0x0000000005A28000-memory.dmp

Filesize
6.1MB

Download
memory/2028-932-0x0000000004C80000-0x0000000004D8A000-memory.dmp

Filesize
1.0MB

Download
memory/2028-933-0x0000000004DC0000-0x0000000004DD2000-memory.dmp

Filesize
72KB

Download
memory/2028-934-0x0000000004DE0000-0x0000000004E1C000-memory.dmp

Filesize
240KB

Download
memory/2028-935-0x0000000005B30000-0x0000000005B7C000-memory.dmp

Filesize
304KB

Download