healer | b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b.exe
Size

1.1MB
MD5

0e228ea8e6f9dc1390f1d51d5f0b661e
SHA1

535d61349ffaf8effcfea271a3083c4ec0a135a7
SHA256

b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b
SHA512

5261fbec095b1f453e23de160148f0413f799c2b50acf12f61bad30b4c9e6e65678b66a9e1738d8b3505f52dbeeb7ecdf4353452ae46530df3a141c5935473aa
SSDEEP

24576:gyrKxOytUAEts2Q/EasZYZXLFWteaHqeuOijEfsSltmw9rWHdhE:nrsftULt/6ExZYZLYMaHqGijEfHtmIEg

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023bad-26.dat	healer
behavioral1/memory/4008-28-0x0000000000430000-0x000000000043A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	az385360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	az385360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	az385360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	az385360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	az385360.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	az385360.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/4476-34-0x0000000004D90000-0x0000000004DCC000-memory.dmp	family_redline
behavioral1/memory/4476-36-0x0000000007190000-0x00000000071CA000-memory.dmp	family_redline
behavioral1/memory/4476-38-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-52-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-100-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-98-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-96-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-92-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-90-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-88-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-86-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-84-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-82-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-80-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-78-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-76-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-74-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-70-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-68-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-66-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-64-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-62-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-60-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-58-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-54-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-50-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-48-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-46-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-44-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-42-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-40-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-94-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-72-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-56-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline
behavioral1/memory/4476-37-0x0000000007190000-0x00000000071C5000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
976	ki541865.exe
732	ki848901.exe
2900	ki636040.exe
4008	az385360.exe
4476	bu785694.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	az385360.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ki541865.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ki848901.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	ki636040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2416	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki541865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki848901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki636040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bu785694.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	az385360.exe
4008	az385360.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	az385360.exe
Token: SeDebugPrivilege	4476	bu785694.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 976	4456	b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b.exe	83
PID 4456 wrote to memory of 976	4456	b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b.exe	83
PID 4456 wrote to memory of 976	4456	b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b.exe	83
PID 976 wrote to memory of 732	976	ki541865.exe	84
PID 976 wrote to memory of 732	976	ki541865.exe	84
PID 976 wrote to memory of 732	976	ki541865.exe	84
PID 732 wrote to memory of 2900	732	ki848901.exe	86
PID 732 wrote to memory of 2900	732	ki848901.exe	86
PID 732 wrote to memory of 2900	732	ki848901.exe	86
PID 2900 wrote to memory of 4008	2900	ki636040.exe	87
PID 2900 wrote to memory of 4008	2900	ki636040.exe	87
PID 2900 wrote to memory of 4476	2900	ki636040.exe	94
PID 2900 wrote to memory of 4476	2900	ki636040.exe	94
PID 2900 wrote to memory of 4476	2900	ki636040.exe	94

C:\Users\Admin\AppData\Local\Temp\b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b.exe
"C:\Users\Admin\AppData\Local\Temp\b48ba90faa714a8387b43e098ccf6d72a401152ac4f55e882c79443a5715f67b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki541865.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki541865.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki848901.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki848901.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki636040.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki636040.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az385360.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az385360.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu785694.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu785694.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki541865.exe

Filesize
918KB

MD5
ce907ea42feea172267ec4938a5938ab

SHA1
e7995699cb180d8e52c5d5d73046c3ae653e9c4f

SHA256
12f1fa0894439c6ded1488731885d059e8433cd890b0ae08a1eae8dbc8b93f56

SHA512
1c63ec71029c7f617fc08fd1e59ba5f431d2b933d80aeedb27710c31787348a5a4c781f9343e3618b55071a5de99091d23825d3e201513ad6c696dca29f399d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki848901.exe

Filesize
695KB

MD5
97456d7cfd7d9fadbe99961ced4f217c

SHA1
9ec3848cf7f259a096acf72b90ea2ff73ca7a934

SHA256
f5cd774db7644c2a6bd1908e683e562e45a8023d1ffec2fbefddf7d6eb761257

SHA512
d06f69d6f622c1d551386233bcdaf7ca7df443cfefcc420f11ff6c5a85dfd1b635d0422151dc8b36ed4af6390ccf150b4d69f8599931a81103b5a4cd412e2185

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki636040.exe

Filesize
415KB

MD5
4360d75ace0e60c105b3173c4676bd7e

SHA1
0452908b5347a28cd699fe3ae880d8657b3beb7a

SHA256
aee247161ae9b8055da807bde7e3cb5492d7bb3e429b665898d53b9da24e2636

SHA512
e0bc5d85535c38121833ee11ff60124c2ca4478f5fe6a789007d5a72884fae6900950ac9a85aa73538050b326f3418052bc5fbed26e4a4bb8f8becbcc3dc5743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az385360.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu785694.exe

Filesize
360KB

MD5
0f04f87d7ea3a5a477ab14499d2d5c84

SHA1
43cd1833a36f497179f2bb33a3cb4531c855822a

SHA256
903d95aa266d2f41c9e32a8c49b231ece9685f404089b8fc0063529e89700a37

SHA512
46ab0368417cbbfbf22b93232d6378229516b1e468ed3bb9fd919505bf4f0a946e5a3d4e8fb61b8feec7c08a2aa5a90fba8fac2337f1d845ee2e0aacb0aa1e3f

Download Submit
memory/4008-28-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/4476-76-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-64-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-36-0x0000000007190000-0x00000000071CA000-memory.dmp

Filesize
232KB

Download
memory/4476-38-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-52-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-100-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-98-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-96-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-92-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-90-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-88-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-86-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-84-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-82-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-80-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-78-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-34-0x0000000004D90000-0x0000000004DCC000-memory.dmp

Filesize
240KB

Download
memory/4476-74-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-70-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-68-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-66-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-35-0x0000000007360000-0x0000000007904000-memory.dmp

Filesize
5.6MB

Download
memory/4476-62-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-60-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-58-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-54-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-50-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-48-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-46-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-44-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-42-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-40-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-94-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-72-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-56-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-37-0x0000000007190000-0x00000000071C5000-memory.dmp

Filesize
212KB

Download
memory/4476-829-0x0000000009C90000-0x000000000A2A8000-memory.dmp

Filesize
6.1MB

Download
memory/4476-830-0x000000000A340000-0x000000000A352000-memory.dmp

Filesize
72KB

Download
memory/4476-831-0x000000000A360000-0x000000000A46A000-memory.dmp

Filesize
1.0MB

Download
memory/4476-832-0x000000000A480000-0x000000000A4BC000-memory.dmp

Filesize
240KB

Download
memory/4476-833-0x0000000004980000-0x00000000049CC000-memory.dmp

Filesize
304KB

Download