healer | 693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5.exe
Size

695KB
MD5

082a104673632dfbbd9e2d15e4dd960e
SHA1

d59206db7645a1b0b7087a8a6d9e558c63611ef7
SHA256

693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5
SHA512

724295bdd6dea9e567545effd637f80a503e39be6c88cd42fb8d6b676b9418d31d0cf013997f732ba341f907baca62dd10b8a2ef4d95c23ef0fd14c53f00fc4c
SSDEEP

12288:ey90Yi8GIB0JHhMuZfYMzyVeAVw4ipCGPeyOl9XEH2AUT0spo:eyq8GK4quZQMYeD4ipnPet22Ap

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3416-18-0x0000000004890000-0x00000000048AA000-memory.dmp	healer
behavioral1/memory/3416-20-0x0000000004CF0000-0x0000000004D08000-memory.dmp	healer
behavioral1/memory/3416-21-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-36-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-46-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-44-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-42-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-40-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-38-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-48-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-34-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-33-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-31-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-28-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-27-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-24-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer
behavioral1/memory/3416-22-0x0000000004CF0000-0x0000000004D02000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr975076.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr975076.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr975076.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr975076.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr975076.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr975076.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/924-59-0x00000000047C0000-0x00000000047FC000-memory.dmp	family_redline
behavioral1/memory/924-60-0x0000000004A50000-0x0000000004A8A000-memory.dmp	family_redline
behavioral1/memory/924-80-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-90-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-94-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-92-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-88-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-86-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-84-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-82-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-78-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-77-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-74-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-72-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-71-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-68-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-66-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-64-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-62-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline
behavioral1/memory/924-61-0x0000000004A50000-0x0000000004A85000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3604	un652116.exe
3416	pr975076.exe
924	qu498070.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr975076.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr975076.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un652116.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5044	3416	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un652116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr975076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu498070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3416	pr975076.exe
3416	pr975076.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	pr975076.exe
Token: SeDebugPrivilege	924	qu498070.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3604	1876	693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5.exe	83
PID 1876 wrote to memory of 3604	1876	693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5.exe	83
PID 1876 wrote to memory of 3604	1876	693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5.exe	83
PID 3604 wrote to memory of 3416	3604	un652116.exe	84
PID 3604 wrote to memory of 3416	3604	un652116.exe	84
PID 3604 wrote to memory of 3416	3604	un652116.exe	84
PID 3604 wrote to memory of 924	3604	un652116.exe	100
PID 3604 wrote to memory of 924	3604	un652116.exe	100
PID 3604 wrote to memory of 924	3604	un652116.exe	100

C:\Users\Admin\AppData\Local\Temp\693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5.exe
"C:\Users\Admin\AppData\Local\Temp\693d633314e8975067259147202a8e7828d990f2798edb6806add226439645c5.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un652116.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un652116.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr975076.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr975076.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1092
      4⤵
      Program crash
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu498070.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu498070.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3416 -ip 3416
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un652116.exe

Filesize
541KB

MD5
40c28f329f09792393a49f804537ad8f

SHA1
c62c33efe4ba16fd96298945b9cb92ccf5394f3d

SHA256
f64a806297ec4ece21ae249fc07842939225424af5ae664f9cb91b608756d1ad

SHA512
ae4ec867c5190e17a76b96468bf238d953612b5268d9b8d4e0da5931a68de8c64c8576c332072dc325682081787dd14aee1e3cc00029ac419f03b99e44a0b769

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr975076.exe

Filesize
269KB

MD5
926f8c41117545ee1e103400b7de535e

SHA1
ed97ad1a1129475be814d2ae64a2975356424b49

SHA256
d137ad20202dfbe272fc6e7db283f6c6eb70fe831252033c62e3b86fd3f12eb9

SHA512
d1956bc30852063a8a62b0fd787c76676e2484a82bd2fd0e2adc812cdbc3ba5ce8df6fda0342119b9e04a94f8d5721a3d69a933148491ecaac58e207963ce843

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu498070.exe

Filesize
352KB

MD5
ccebcbe9c839d2201f72713b05ab414d

SHA1
d8dab301eff77da96969f952494f62832be04bea

SHA256
586d222657c5e9361266367c9f4b3b3eb5a947db993a14f4c3d24d46ee344f82

SHA512
c2b10e37f7347a5ac98285b21679695dc772a0f3edfde8c60ddf6759fab0709b2a0bd25a54b075f66d0be1b6feb1b9c72f1cbf0e75daa7ac12cea8ff34f6b337

Download Submit
memory/924-72-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-77-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-854-0x0000000004EA0000-0x0000000004EB2000-memory.dmp

Filesize
72KB

Download
memory/924-853-0x0000000009E40000-0x000000000A458000-memory.dmp

Filesize
6.1MB

Download
memory/924-61-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-62-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-64-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-66-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-68-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-71-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-856-0x0000000004FE0000-0x000000000501C000-memory.dmp

Filesize
240KB

Download
memory/924-59-0x00000000047C0000-0x00000000047FC000-memory.dmp

Filesize
240KB

Download
memory/924-74-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-855-0x000000000A460000-0x000000000A56A000-memory.dmp

Filesize
1.0MB

Download
memory/924-78-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-82-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-84-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-86-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-88-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-92-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-94-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-90-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-80-0x0000000004A50000-0x0000000004A85000-memory.dmp

Filesize
212KB

Download
memory/924-60-0x0000000004A50000-0x0000000004A8A000-memory.dmp

Filesize
232KB

Download
memory/924-857-0x0000000004960000-0x00000000049AC000-memory.dmp

Filesize
304KB

Download
memory/3416-40-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-53-0x0000000000400000-0x0000000002BAD000-memory.dmp

Filesize
39.7MB

Download
memory/3416-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3416-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3416-50-0x0000000000400000-0x0000000002BAD000-memory.dmp

Filesize
39.7MB

Download
memory/3416-49-0x0000000002BD0000-0x0000000002CD0000-memory.dmp

Filesize
1024KB

Download
memory/3416-22-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-24-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-27-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-28-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-31-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-33-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-34-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-48-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-38-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-42-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-44-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-46-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-36-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-21-0x0000000004CF0000-0x0000000004D02000-memory.dmp

Filesize
72KB

Download
memory/3416-20-0x0000000004CF0000-0x0000000004D08000-memory.dmp

Filesize
96KB

Download
memory/3416-19-0x00000000071D0000-0x0000000007774000-memory.dmp

Filesize
5.6MB

Download
memory/3416-18-0x0000000004890000-0x00000000048AA000-memory.dmp

Filesize
104KB

Download
memory/3416-16-0x0000000002CD0000-0x0000000002CFD000-memory.dmp

Filesize
180KB

Download
memory/3416-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3416-15-0x0000000002BD0000-0x0000000002CD0000-memory.dmp

Filesize
1024KB

Download