healer | e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe
Size

935KB
MD5

742ec7b0f5819ad8a64dfa470a214338
SHA1

a003b7ea84b97cb4981ee3e5b7b090821b0bfa4c
SHA256

e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07
SHA512

0dcb033495cb3c82df7d977106a5c937e95a66fa50d3bec4c513d1c8f039bf03d6d3424299a46882e2d20835b3fc8ca81feef18f54983793963761b5a432c316
SSDEEP

24576:8yzjlJn3Yjr6nVYaXljPXSxKRYorM67hNmezg:rzJJn3YjreXj6KFXYQ

Score

10^/10

healer redline dark discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

dark

185.161.248.73:4164

Attributes

auth_value
ae85b01f66afe8770afeed560513fc2d

Signatures

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/1440-2151-0x0000000005730000-0x000000000573A000-memory.dmp	healer
behavioral1/files/0x0002000000022ab7-2156.dat	healer
behavioral1/memory/3852-2164-0x0000000000220000-0x000000000022A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/2304-4321-0x0000000005760000-0x0000000005792000-memory.dmp	family_redline
behavioral1/files/0x0007000000023cae-4326.dat	family_redline
behavioral1/memory/4732-4328-0x0000000000130000-0x0000000000160000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	69370685.exe

Executes dropped EXE 5 IoCs

pid	Process
2328	un544849.exe
1440	69370685.exe
3852	1.exe
2304	rk246842.exe
4732	si146151.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un544849.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4200	1440	WerFault.exe	84
5824	2304	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69370685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rk246842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si146151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un544849.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3852	1.exe
3852	1.exe
3852	1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	69370685.exe
Token: SeDebugPrivilege	2304	rk246842.exe
Token: SeDebugPrivilege	3852	1.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2328	2676	e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe	83
PID 2676 wrote to memory of 2328	2676	e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe	83
PID 2676 wrote to memory of 2328	2676	e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe	83
PID 2328 wrote to memory of 1440	2328	un544849.exe	84
PID 2328 wrote to memory of 1440	2328	un544849.exe	84
PID 2328 wrote to memory of 1440	2328	un544849.exe	84
PID 1440 wrote to memory of 3852	1440	69370685.exe	88
PID 1440 wrote to memory of 3852	1440	69370685.exe	88
PID 2328 wrote to memory of 2304	2328	un544849.exe	94
PID 2328 wrote to memory of 2304	2328	un544849.exe	94
PID 2328 wrote to memory of 2304	2328	un544849.exe	94
PID 2676 wrote to memory of 4732	2676	e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe	100
PID 2676 wrote to memory of 4732	2676	e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe	100
PID 2676 wrote to memory of 4732	2676	e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe	100

C:\Users\Admin\AppData\Local\Temp\e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe
"C:\Users\Admin\AppData\Local\Temp\e93558b862ae428f469fc3e24408c79832ce3920059d5f0beb254b1561c5fe07.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un544849.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un544849.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69370685.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69370685.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 1336
      4⤵
      Program crash
      PID:4200
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk246842.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk246842.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1268
      4⤵
      Program crash
      PID:5824
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146151.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146151.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1440 -ip 1440
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2304 -ip 2304
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146151.exe

Filesize
170KB

MD5
ae1ba64da521107921acb5e0501c979a

SHA1
786e61016a24ee9068a3bf1b3aca97d24c5f24ea

SHA256
bedd5bf49a3313f3b5cb729be8d9476834eff8de39b468acd3bbc06f5e60a644

SHA512
ef304f6c7398edaeaed5262d66a8cdb83c1d14a34293810729278cf1cae454c8a65efd1b05c4bf431912ca12fdd1a33502aa6380ddfd9949bb666c51c14bfe78

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un544849.exe

Filesize
782KB

MD5
1d036d43b4561854c54507d5a6b9b36b

SHA1
90e18d1b86bcaf3f738c8ce23ae9525a022d6491

SHA256
f155f1acb902f8c6721757e8d367cafe9b2a1cc2fbfca103a8ee154c1f473246

SHA512
1ff714decf283c25cfc8073cdf84f782def01ba928bbd3e5c42cce1f73b7d6fe86f26d971481de62d51435d728bf427a03fcf6a6a5a44d2f5f6e1f688a7082f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\69370685.exe

Filesize
522KB

MD5
9676c1fbc4520202dd69e528976f5b67

SHA1
bec8055ebc1b8d1570b813209e724650d5f3e50b

SHA256
787dcd3b76a499cd04367ff2df723fcedd727b0b0aee3d376bcf88ae70bc12df

SHA512
640d3bfbbd386ded16e977c3f839d957817a8a8e49531e4c5db5fa94b91e24eea662fa4c7e246d175e2515ac15427199a1b092dc97435eebe741cd6f8c47ffe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk246842.exe

Filesize
582KB

MD5
02586e5857f002f643fa0222fbe652c8

SHA1
f41bd216c165fd19d6256dfe3883d646f10b9021

SHA256
9aae79d4e43ea4d2c5182a2217a0fc677e52390d4192ffd368dc6edd8409d07c

SHA512
665648e9af574583df0ab3cbeb1cf5c6a52a3b573ac0fe5b9a8ea1954c80a827dcc70fa588f9a2430fc6c2d439b63c1b13156876e73dc8e3bb66c45b1b33914a

Download Submit
C:\Windows\Temp\1.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/1440-49-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-23-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-20-0x0000000004F30000-0x00000000054D4000-memory.dmp

Filesize
5.6MB

Download
memory/1440-21-0x0000000005520000-0x0000000005576000-memory.dmp

Filesize
344KB

Download
memory/1440-69-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-47-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-39-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-22-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-85-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-84-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-81-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-79-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-78-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-75-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-73-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-71-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-67-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-66-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-63-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-38-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-59-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-57-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-55-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-53-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-51-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-18-0x0000000000400000-0x0000000000828000-memory.dmp

Filesize
4.2MB

Download
memory/1440-45-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-44-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-41-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-19-0x0000000004D70000-0x0000000004DC8000-memory.dmp

Filesize
352KB

Download
memory/1440-61-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-35-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-33-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-31-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-29-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-27-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-25-0x0000000005520000-0x0000000005571000-memory.dmp

Filesize
324KB

Download
memory/1440-2150-0x0000000000830000-0x0000000000930000-memory.dmp

Filesize
1024KB

Download
memory/1440-2151-0x0000000005730000-0x000000000573A000-memory.dmp

Filesize
40KB

Download
memory/1440-17-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1440-15-0x0000000000830000-0x0000000000930000-memory.dmp

Filesize
1024KB

Download
memory/1440-2167-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1440-2166-0x0000000000A40000-0x0000000000A8C000-memory.dmp

Filesize
304KB

Download
memory/1440-2168-0x0000000000400000-0x0000000000828000-memory.dmp

Filesize
4.2MB

Download
memory/1440-16-0x0000000000A40000-0x0000000000A8C000-memory.dmp

Filesize
304KB

Download
memory/2304-2173-0x0000000004D70000-0x0000000004DD8000-memory.dmp

Filesize
416KB

Download
memory/2304-2174-0x0000000005530000-0x0000000005596000-memory.dmp

Filesize
408KB

Download
memory/2304-4321-0x0000000005760000-0x0000000005792000-memory.dmp

Filesize
200KB

Download
memory/2304-4322-0x00000000057A0000-0x0000000005832000-memory.dmp

Filesize
584KB

Download
memory/3852-2164-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/4732-4328-0x0000000000130000-0x0000000000160000-memory.dmp

Filesize
192KB

Download
memory/4732-4329-0x0000000004A50000-0x0000000004A56000-memory.dmp

Filesize
24KB

Download
memory/4732-4330-0x00000000051F0000-0x0000000005808000-memory.dmp

Filesize
6.1MB

Download
memory/4732-4331-0x0000000004CE0000-0x0000000004DEA000-memory.dmp

Filesize
1.0MB

Download
memory/4732-4332-0x0000000004BF0000-0x0000000004C02000-memory.dmp

Filesize
72KB

Download
memory/4732-4333-0x0000000004C50000-0x0000000004C8C000-memory.dmp

Filesize
240KB

Download
memory/4732-4334-0x0000000004DF0000-0x0000000004E3C000-memory.dmp

Filesize
304KB

Download