healer | 8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b.exe
Size

1.1MB
MD5

347b83f1868618157f6dc69b5f9be059
SHA1

b48972addb3296f35a3d37d5a419f091958a9d31
SHA256

8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b
SHA512

0355e2718fae36c343460f87d7bfffddd25ca195bf550804fba1e9796f0aa42f8abb8dd3a03b7c1c8d0d626ea34bedf29b04403921071977587304c5fc8afef1
SSDEEP

24576:oy4BCXco1F2NmP85jJxVyeafZKHqLgBRcDZR5e4Zz3GPI:vDQm6xVhagHqLgBR6fh

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/1340-23-0x00000000026B0000-0x00000000026CA000-memory.dmp	healer
behavioral1/memory/1340-25-0x0000000002810000-0x0000000002828000-memory.dmp	healer
behavioral1/memory/1340-41-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-53-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-51-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-49-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-47-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-45-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-43-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-39-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-37-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-35-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-33-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-31-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-29-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-27-0x0000000002810000-0x0000000002822000-memory.dmp	healer
behavioral1/memory/1340-26-0x0000000002810000-0x0000000002822000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr298688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr298688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr298688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr298688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr298688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr298688.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/444-62-0x0000000002710000-0x000000000274C000-memory.dmp	family_redline
behavioral1/memory/444-63-0x0000000004E10000-0x0000000004E4A000-memory.dmp	family_redline
behavioral1/memory/444-77-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-75-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-97-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-93-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-91-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-89-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-87-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-85-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-83-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-81-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-79-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-73-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-71-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-69-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-95-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-67-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-65-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/444-64-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4976	un885664.exe
2884	un868040.exe
1340	pr298688.exe
444	qu097949.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr298688.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr298688.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un885664.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un868040.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	1340	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un885664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un868040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr298688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu097949.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1340	pr298688.exe
1340	pr298688.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	pr298688.exe
Token: SeDebugPrivilege	444	qu097949.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4976	740	8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b.exe	83
PID 740 wrote to memory of 4976	740	8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b.exe	83
PID 740 wrote to memory of 4976	740	8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b.exe	83
PID 4976 wrote to memory of 2884	4976	un885664.exe	84
PID 4976 wrote to memory of 2884	4976	un885664.exe	84
PID 4976 wrote to memory of 2884	4976	un885664.exe	84
PID 2884 wrote to memory of 1340	2884	un868040.exe	86
PID 2884 wrote to memory of 1340	2884	un868040.exe	86
PID 2884 wrote to memory of 1340	2884	un868040.exe	86
PID 2884 wrote to memory of 444	2884	un868040.exe	99
PID 2884 wrote to memory of 444	2884	un868040.exe	99
PID 2884 wrote to memory of 444	2884	un868040.exe	99

C:\Users\Admin\AppData\Local\Temp\8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b.exe
"C:\Users\Admin\AppData\Local\Temp\8cc1938f69f892be290272eb40d02e9ce4d8cdbecb8e9bc9375beb6dc0b3367b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un885664.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un885664.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un868040.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un868040.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr298688.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr298688.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 1084
        5⤵
        Program crash
        
        PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu097949.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu097949.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1340 -ip 1340
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un885664.exe

Filesize
763KB

MD5
3e72ae657998382d0cfce81ea59b0c32

SHA1
5a587df43b693a91c31c4cf17171d95b7903ce91

SHA256
b3e7fc523d8fc33c236270039f3eb81d9184706429b3958f5f6364f118d67d33

SHA512
b5260b257b71013cab7f9b14c5a1d467364644bec39c0b7dd83f3cc6e683522853f814500aeeef35b14170a36aa6a26156b8315fbdcb876d6cfa7d6e8aa7c541

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un868040.exe

Filesize
609KB

MD5
d405530db0fbf55142436f8ea7f212e6

SHA1
248c364877dd89fdf44e0b828630a0e39e85b41f

SHA256
f07c58f7de662ae7ee52caed60669c9f7f646dc6741515c25ec7536035c657f2

SHA512
2fac63d21e5047d8f1d2a42ab93e4cd5170e9f90268bc38e5bcbb1605eaab769ded94efc027f9148e9beae31dff272420fd5c1cb122ba7fea81635fd37f673a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr298688.exe

Filesize
403KB

MD5
4b18fa0ebbe3c3df24d215bfb6e0544a

SHA1
1210aeb69adc0ef97c5a5c4c1beb7705974cbb57

SHA256
3f131ade4af00562469fc4945764710ca5ccd8e0624cf1dc832c9ad7214df9c2

SHA512
99f940a96a544a8e77f2d0b9869b78c223e0e7e89244a0d91d0a412aa622102fe9fad9a92703e6a15fa44828d42c70470d8d58dccc9c77dddcbc889a20a8593b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu097949.exe

Filesize
485KB

MD5
d78d7b03e559c994d6cefd84c67584ee

SHA1
47714b12d59e612f66c7db4ee755dc0c7144492b

SHA256
123a3163cc3232e61e160c936929bf2fc4cc8244c20ddae8662013411827a3e7

SHA512
2c2a584efa9bf42d6ed85f3767095fc831e17873da55e6a9c5561d7301030dbab89497a76de84741074f308c1160d510952c00b6401429b302b06cf5ede46cdb

Download Submit
memory/444-71-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-81-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-857-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/444-856-0x0000000007910000-0x0000000007F28000-memory.dmp

Filesize
6.1MB

Download
memory/444-64-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-65-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-67-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-95-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-859-0x00000000080E0000-0x000000000811C000-memory.dmp

Filesize
240KB

Download
memory/444-69-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-75-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-73-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-79-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-858-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/444-83-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-85-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-87-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-89-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-91-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-93-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-860-0x0000000004900000-0x000000000494C000-memory.dmp

Filesize
304KB

Download
memory/444-97-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/444-62-0x0000000002710000-0x000000000274C000-memory.dmp

Filesize
240KB

Download
memory/444-63-0x0000000004E10000-0x0000000004E4A000-memory.dmp

Filesize
232KB

Download
memory/444-77-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/1340-45-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-57-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/1340-54-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/1340-55-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/1340-26-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-27-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-29-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-31-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-33-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-35-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-37-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-39-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-43-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-47-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-49-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-51-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-53-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-41-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1340-25-0x0000000002810000-0x0000000002828000-memory.dmp

Filesize
96KB

Download
memory/1340-24-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/1340-23-0x00000000026B0000-0x00000000026CA000-memory.dmp

Filesize
104KB

Download
memory/1340-22-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download