healer | 7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe
Size

647KB
MD5

4f666acf6402d6ebbf5d3096ab322c0b
SHA1

020cddf6c62d1ffd35a3981027ce71c606fad9ef
SHA256

7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad
SHA512

be5bca128943c33a6ff07ed369d15816f0f1b0266af1b553dc3981f240716fbcd149a78efb107767b7e73786f7b469ebead9f80999c0d4924df380e70aaaa1fd
SSDEEP

12288:oMrzy90V2TIn8Zd9ALonvr+AVlcMEZ5uzSVrPw4o9sioOvwq4BvJ:ry4oIn8ZXgkhVQCmRwVjv1mJ

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cc4-12.dat	healer
behavioral1/memory/4384-15-0x0000000000B00000-0x0000000000B0A000-memory.dmp	healer
behavioral1/memory/3392-22-0x00000000022A0000-0x00000000022BA000-memory.dmp	healer
behavioral1/memory/3392-24-0x0000000002450000-0x0000000002468000-memory.dmp	healer
behavioral1/memory/3392-25-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-52-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-50-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-48-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-46-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-44-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-42-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-40-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-38-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-36-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-34-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-32-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-30-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-28-0x0000000002450000-0x0000000002462000-memory.dmp	healer
behavioral1/memory/3392-26-0x0000000002450000-0x0000000002462000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b4843JN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b4843JN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c47xS71.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c47xS71.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c47xS71.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b4843JN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b4843JN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b4843JN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b4843JN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c47xS71.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c47xS71.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c47xS71.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3928-60-0x0000000004A30000-0x0000000004A76000-memory.dmp	family_redline
behavioral1/memory/3928-61-0x0000000004AB0000-0x0000000004AF4000-memory.dmp	family_redline
behavioral1/memory/3928-63-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-71-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-95-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-93-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-89-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-87-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-85-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-83-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-81-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-79-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-75-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-73-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-69-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-67-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-65-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-91-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-77-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline
behavioral1/memory/3928-62-0x0000000004AB0000-0x0000000004AEE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
3856	nice8571.exe
4384	b4843JN.exe
3392	c47xS71.exe
3928	dGdWI69.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b4843JN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c47xS71.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c47xS71.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nice8571.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4352	3392	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nice8571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c47xS71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dGdWI69.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4384	b4843JN.exe
4384	b4843JN.exe
3392	c47xS71.exe
3392	c47xS71.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4384	b4843JN.exe
Token: SeDebugPrivilege	3392	c47xS71.exe
Token: SeDebugPrivilege	3928	dGdWI69.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3856	1956	7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe	83
PID 1956 wrote to memory of 3856	1956	7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe	83
PID 1956 wrote to memory of 3856	1956	7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe	83
PID 3856 wrote to memory of 4384	3856	nice8571.exe	84
PID 3856 wrote to memory of 4384	3856	nice8571.exe	84
PID 3856 wrote to memory of 3392	3856	nice8571.exe	93
PID 3856 wrote to memory of 3392	3856	nice8571.exe	93
PID 3856 wrote to memory of 3392	3856	nice8571.exe	93
PID 1956 wrote to memory of 3928	1956	7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe	97
PID 1956 wrote to memory of 3928	1956	7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe	97
PID 1956 wrote to memory of 3928	1956	7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe	97

C:\Users\Admin\AppData\Local\Temp\7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe
"C:\Users\Admin\AppData\Local\Temp\7df5ad8f7d2bc1b5f54ab1ff586be6f5dfd367db8b42dfe12f13b17c18c9dfad.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8571.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8571.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4843JN.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4843JN.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c47xS71.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c47xS71.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 1080
      4⤵
      Program crash
      PID:4352
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dGdWI69.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dGdWI69.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3392 -ip 3392
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dGdWI69.exe

Filesize
305KB

MD5
62ec705f79a48b72642f8cd85939fb34

SHA1
87572d53a6870950cd49eed7c60560e4cb803223

SHA256
bb047d05b8033b2a6fff4be5fc331dbc7093dbc27ef7aa250b15ed7825aa2764

SHA512
ec3d66c62da8e7d6586b15818ce38f451ea2141f2743955163c769517f6ea40377f713831b9963b1457abece69b79f1d8e4251688eca6a6fefe1484c1c922f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8571.exe

Filesize
324KB

MD5
31cab0c32c303c2f010875eef9bf7aab

SHA1
29287d4e5c27b850b91dbea68c4b67732f2d692e

SHA256
666ebd82c1660df1b719ce10b5ed5ddd424020e4e94ad62361339d90d6aa911c

SHA512
6276ea0548eded773023a35b4a30e47f1eb88f336fca8a3cdd34f235d0b2d92d18af8755d671bc2c17f107a34b084c192df7db82e245715b33c28b9fb9496927

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b4843JN.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c47xS71.exe

Filesize
247KB

MD5
6b954225e48c2af4b080ebc5d7b97b78

SHA1
06b196c030a1295dc98c9cbd6cd16087741b493d

SHA256
93fec7f623085bf9bf167817ab99d7ffcbd75966841f0082a27ff8bf3723dad1

SHA512
8c4c9f22d36bccf82edcc7ee0d503d98729a39ff63b302edf00782af9b3732d19475ac01fc38fd7630de6bdc6ab97a29a50050f8897fef5882f3e7df272f6405

Download Submit
memory/3392-26-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-54-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3392-22-0x00000000022A0000-0x00000000022BA000-memory.dmp

Filesize
104KB

Download
memory/3392-23-0x0000000004C00000-0x00000000051A4000-memory.dmp

Filesize
5.6MB

Download
memory/3392-24-0x0000000002450000-0x0000000002468000-memory.dmp

Filesize
96KB

Download
memory/3392-25-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-52-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-50-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-48-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-46-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-44-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-42-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-40-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-38-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-36-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-34-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-32-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-30-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3392-28-0x0000000002450000-0x0000000002462000-memory.dmp

Filesize
72KB

Download
memory/3928-62-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-81-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-972-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download
memory/3928-971-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/3928-60-0x0000000004A30000-0x0000000004A76000-memory.dmp

Filesize
280KB

Download
memory/3928-93-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-71-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-95-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-63-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-89-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-87-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-85-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-83-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-970-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/3928-79-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-75-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-73-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-69-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-67-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-65-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-91-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-77-0x0000000004AB0000-0x0000000004AEE000-memory.dmp

Filesize
248KB

Download
memory/3928-61-0x0000000004AB0000-0x0000000004AF4000-memory.dmp

Filesize
272KB

Download
memory/3928-968-0x0000000005100000-0x0000000005718000-memory.dmp

Filesize
6.1MB

Download
memory/3928-969-0x00000000057A0000-0x00000000058AA000-memory.dmp

Filesize
1.0MB

Download
memory/4384-15-0x0000000000B00000-0x0000000000B0A000-memory.dmp

Filesize
40KB

Download
memory/4384-16-0x00007FFA5E2E3000-0x00007FFA5E2E5000-memory.dmp

Filesize
8KB

Download
memory/4384-14-0x00007FFA5E2E3000-0x00007FFA5E2E5000-memory.dmp

Filesize
8KB

Download