healer | ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exe
Size

761KB
MD5

b9c07cad096f96ed7c79720f7c071119
SHA1

bb2a78d895674e1737aa5dbd57394bcf9686196e
SHA256

ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7
SHA512

59db0b2c40314f65b89b89a6ead3523e2c0673e9d739c7e502164a739b4acace9e3fd643e6b95b4809540e6f8935e79e459928f594a79a34b7c438138717a606
SSDEEP

12288:Uy90d89P603MMihR/1aikHYUeTLDnvHFYmqIqMPJuM+CZeKlmbwox:UyYDhR/9kHYHjfiBHMhubC8Klmbwox

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2648-19-0x00000000028A0000-0x00000000028BA000-memory.dmp	healer
behavioral1/memory/2648-21-0x0000000005360000-0x0000000005378000-memory.dmp	healer
behavioral1/memory/2648-49-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-47-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-45-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-43-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-41-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-39-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-37-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-35-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-33-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-31-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-29-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-27-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-25-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-23-0x0000000005360000-0x0000000005372000-memory.dmp	healer
behavioral1/memory/2648-22-0x0000000005360000-0x0000000005372000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pr825630.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr825630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr825630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr825630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr825630.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr825630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr825630.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4920-61-0x00000000029D0000-0x0000000002A0C000-memory.dmp	family_redline
behavioral1/memory/4920-62-0x0000000004E10000-0x0000000004E4A000-memory.dmp	family_redline
behavioral1/memory/4920-66-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-76-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-96-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-94-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-92-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-90-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-88-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-86-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-84-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-82-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-80-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-74-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-72-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-70-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-68-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-78-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-64-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline
behavioral1/memory/4920-63-0x0000000004E10000-0x0000000004E45000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un699261.exepr825630.exequ938716.exe

pid process

2388 un699261.exe
2648 pr825630.exe
4920 qu938716.exe

pid	process
2388	un699261.exe
2648	pr825630.exe
4920	qu938716.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pr825630.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr825630.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr825630.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exeun699261.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un699261.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

668 2648 WerFault.exe pr825630.exe

pid	pid_target	process	target process
668	2648	WerFault.exe	pr825630.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

pr825630.exequ938716.exeef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exeun699261.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr825630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu938716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un699261.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pr825630.exe

pid process

2648 pr825630.exe
2648 pr825630.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pr825630.exequ938716.exe

description pid process

Token: SeDebugPrivilege 2648 pr825630.exe
Token: SeDebugPrivilege 4920 qu938716.exe

pid	process
2648	pr825630.exe
2648	pr825630.exe

description	pid	process
Token: SeDebugPrivilege	2648	pr825630.exe
Token: SeDebugPrivilege	4920	qu938716.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exeun699261.exe

description	pid	process	target process
PID 4972 wrote to memory of 2388	4972	ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exe	un699261.exe
PID 4972 wrote to memory of 2388	4972	ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exe	un699261.exe
PID 4972 wrote to memory of 2388	4972	ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exe	un699261.exe
PID 2388 wrote to memory of 2648	2388	un699261.exe	pr825630.exe
PID 2388 wrote to memory of 2648	2388	un699261.exe	pr825630.exe
PID 2388 wrote to memory of 2648	2388	un699261.exe	pr825630.exe
PID 2388 wrote to memory of 4920	2388	un699261.exe	qu938716.exe
PID 2388 wrote to memory of 4920	2388	un699261.exe	qu938716.exe
PID 2388 wrote to memory of 4920	2388	un699261.exe	qu938716.exe

C:\Users\Admin\AppData\Local\Temp\ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exe
"C:\Users\Admin\AppData\Local\Temp\ef937da6845f00661aaeb1c82c713540b6f4bf014561f2cac2c3ce11195f41c7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699261.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699261.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr825630.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr825630.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1080
      4⤵
      Program crash
      PID:668
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu938716.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu938716.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2648 -ip 2648
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un699261.exe

Filesize
607KB

MD5
9bf3797d0e57afda8813d45522dc7fe0

SHA1
f264e2ad5a549160770a8ffd029a1b4a7f0ddafd

SHA256
ec9590f9d075ac2927d0cbfd104dd7dba353734031a0003a34304e89b0b916b7

SHA512
e361b54ef4ac2e96a51505b34f53a5e66261d2d3a8c4991d1d4a3a7886c575d0a235683c80fd2ae26e74317ae213782bc0e5a471a36794e3c1b1daf5dfc07f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr825630.exe

Filesize
405KB

MD5
ff713fd6e5a8b0b50b7b614d34385264

SHA1
66dd3de434298c2f3c593dc632d2a37fa7384cae

SHA256
d2c295affb35c12b93837bc2e374800bee6481649a6e0a977d532a402b424feb

SHA512
676fe2e3bcf4e375e9c766d3c000f744b3167c73362c10fe6b4e31606cc64fe442d1a9ac24472c14c9a1b7aa94d873ac4c9bedbecad668e5edd4881d0e4b51ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu938716.exe

Filesize
488KB

MD5
baa5a22afd25234651e01e953972669f

SHA1
e53a77863e685f67b2ea5e6720b5a69450dd9e3b

SHA256
88c490a5ec0befb8093603650a7a1f7f1b148b82807dbd07c192ce7e427848df

SHA512
4793c5161effcf25dd80e7a04060a6516f06b06723f4e2de428c9fd7ee7b10bf82da5c34377df68601562ef4fcb7b68850a4d46d8c60b5597f28c38fcc10dddf

Download Submit
memory/2648-15-0x00000000008F0000-0x00000000009F0000-memory.dmp

Filesize
1024KB

Download
memory/2648-16-0x0000000000860000-0x000000000088D000-memory.dmp

Filesize
180KB

Download
memory/2648-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2648-18-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/2648-19-0x00000000028A0000-0x00000000028BA000-memory.dmp

Filesize
104KB

Download
memory/2648-21-0x0000000005360000-0x0000000005378000-memory.dmp

Filesize
96KB

Download
memory/2648-20-0x0000000004D70000-0x0000000005314000-memory.dmp

Filesize
5.6MB

Download
memory/2648-49-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-47-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-45-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-43-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-41-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-39-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-37-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-35-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-33-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-31-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-29-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-27-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-25-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-23-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-22-0x0000000005360000-0x0000000005372000-memory.dmp

Filesize
72KB

Download
memory/2648-50-0x00000000008F0000-0x00000000009F0000-memory.dmp

Filesize
1024KB

Download
memory/2648-51-0x0000000000860000-0x000000000088D000-memory.dmp

Filesize
180KB

Download
memory/2648-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2648-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2648-55-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/4920-61-0x00000000029D0000-0x0000000002A0C000-memory.dmp

Filesize
240KB

Download
memory/4920-62-0x0000000004E10000-0x0000000004E4A000-memory.dmp

Filesize
232KB

Download
memory/4920-66-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-76-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-96-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-94-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-92-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-90-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-88-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-86-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-84-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-82-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-80-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-74-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-72-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-70-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-68-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-78-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-64-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-63-0x0000000004E10000-0x0000000004E45000-memory.dmp

Filesize
212KB

Download
memory/4920-855-0x0000000007920000-0x0000000007F38000-memory.dmp

Filesize
6.1MB

Download
memory/4920-856-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/4920-857-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/4920-858-0x00000000080E0000-0x000000000811C000-memory.dmp

Filesize
240KB

Download
memory/4920-859-0x0000000002590000-0x00000000025DC000-memory.dmp

Filesize
304KB

Download