healer | f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2.exe
Size

560KB
MD5

82660e9656b25a9a44561a8e5c8a895c
SHA1

eee3c41baae37e82be291b20be2a08e331080c14
SHA256

f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2
SHA512

48ca039cc6a7d59430f7a09e9fa7aff77a5b0fdbd3942a620c9abc1c935e0f179155d189a6f9fd0497b9cc4c64be127a0cc2c952402430152c7550ad8d0f9721
SSDEEP

12288:rMr6y90ww4tBfbxf+QdyAf8K5n8ElM0yuJEZ8p1PyGYWR:pylXtBfbZ+qyK8K9pM0yuuZeNz3R

Score

10^/10

healer redline ronam discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

ronam

193.233.20.17:4139

Attributes

auth_value
125421d19d14dd7fd211bc7f6d4aea6c

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c80-12.dat	healer
behavioral1/memory/1028-15-0x00000000003A0000-0x00000000003AA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	dxW29Kb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	dxW29Kb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	dxW29Kb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	dxW29Kb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	dxW29Kb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	dxW29Kb.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/956-22-0x0000000002590000-0x00000000025D6000-memory.dmp	family_redline
behavioral1/memory/956-24-0x0000000002650000-0x0000000002694000-memory.dmp	family_redline
behavioral1/memory/956-72-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-74-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-88-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-86-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-84-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-82-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-80-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-78-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-76-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-70-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-68-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-66-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-64-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-62-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-60-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-58-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-56-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-54-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-52-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-48-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-46-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-44-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-42-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-40-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-38-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-36-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-34-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-30-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-28-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-50-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-32-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-26-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline
behavioral1/memory/956-25-0x0000000002650000-0x000000000268E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4620	nSF89XC03.exe
1028	dxW29Kb.exe
956	eiK68eb.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	dxW29Kb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nSF89XC03.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5088	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nSF89XC03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eiK68eb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	dxW29Kb.exe
1028	dxW29Kb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	dxW29Kb.exe
Token: SeDebugPrivilege	956	eiK68eb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 4620	876	f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2.exe	84
PID 876 wrote to memory of 4620	876	f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2.exe	84
PID 876 wrote to memory of 4620	876	f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2.exe	84
PID 4620 wrote to memory of 1028	4620	nSF89XC03.exe	85
PID 4620 wrote to memory of 1028	4620	nSF89XC03.exe	85
PID 4620 wrote to memory of 956	4620	nSF89XC03.exe	93
PID 4620 wrote to memory of 956	4620	nSF89XC03.exe	93
PID 4620 wrote to memory of 956	4620	nSF89XC03.exe	93

C:\Users\Admin\AppData\Local\Temp\f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2.exe
"C:\Users\Admin\AppData\Local\Temp\f8b98139f0ed069f9b827283e4b3325acc0fb51f7b63eaa70ead0e6235e547c2.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nSF89XC03.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nSF89XC03.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dxW29Kb.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dxW29Kb.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eiK68eb.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eiK68eb.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:956

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nSF89XC03.exe

Filesize
416KB

MD5
02a19752010ca97852957f2c0b4c31b8

SHA1
01bfa4f532156078d7fa773019969851d066b225

SHA256
038e31ee3346472921526da95da2a8edca34621930798ac1e91a9975cb2ef066

SHA512
85338b965c7b45414c50cf92cffbaf3a74aed785fd79eff9bcfb26ad30d6750e021b1117f58763e5073bb5183749f0df14eb44cd93c24865618a9b93a44421bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dxW29Kb.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eiK68eb.exe

Filesize
349KB

MD5
5aa6e9bac1bee1dca3b7a5d420766c2d

SHA1
88f97330ccd57f3c960ea564fc7ab8a260ce9aef

SHA256
f4565199231418a4e651250524064d521d249ea5fe006f66c29f4f765877b47c

SHA512
e8f98d0efbbd42276c46f075227e17a1b823726ab8cabff60ad7d8efd9a8a1502e300a5fa3c9323218382ef0fb50d6f475f790e9567681a658336792e35c771b

Download Submit
memory/956-62-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-22-0x0000000002590000-0x00000000025D6000-memory.dmp

Filesize
280KB

Download
memory/956-935-0x0000000005B60000-0x0000000005BAC000-memory.dmp

Filesize
304KB

Download
memory/956-58-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-23-0x0000000004E90000-0x0000000005434000-memory.dmp

Filesize
5.6MB

Download
memory/956-24-0x0000000002650000-0x0000000002694000-memory.dmp

Filesize
272KB

Download
memory/956-72-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-74-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-88-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-86-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-60-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-82-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-56-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-78-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-76-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-70-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-68-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-66-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-64-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-934-0x00000000028C0000-0x00000000028FC000-memory.dmp

Filesize
240KB

Download
memory/956-84-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-933-0x00000000028A0000-0x00000000028B2000-memory.dmp

Filesize
72KB

Download
memory/956-80-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-54-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-52-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-48-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-46-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-44-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-42-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-40-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-38-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-36-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-34-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-30-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-28-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-50-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-32-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-26-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-25-0x0000000002650000-0x000000000268E000-memory.dmp

Filesize
248KB

Download
memory/956-931-0x0000000005440000-0x0000000005A58000-memory.dmp

Filesize
6.1MB

Download
memory/956-932-0x0000000004D60000-0x0000000004E6A000-memory.dmp

Filesize
1.0MB

Download
memory/1028-16-0x00007FFE56383000-0x00007FFE56385000-memory.dmp

Filesize
8KB

Download
memory/1028-14-0x00007FFE56383000-0x00007FFE56385000-memory.dmp

Filesize
8KB

Download
memory/1028-15-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download