healer | 0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exe
Size

1.1MB
MD5

ca36a36b5306f948d00adbbc7a0078c4
SHA1

d5213bd008eb701cc4c10cb9ec21caa94e074ba0
SHA256

0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c
SHA512

a05105799e5ddf16688d2b03e1fb89fe79d5bc725546a8654a043aab738d421af4ec596a56729dd5c40cdd1e41cbec86144028a993ab67d6526db6fe41edaacc
SSDEEP

24576:LyuJq4vI/CQ0fGv8+lsPUJYII/9lJtpxHOQd:+upI61fGvJsPaYJ/91LuQ

Score

10^/10

healer redline discovery dropper evasion infostealer persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az762177.exe	healer
behavioral1/memory/1012-28-0x0000000000620000-0x000000000062A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

az762177.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	az762177.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	az762177.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	az762177.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	az762177.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	az762177.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	az762177.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4388-34-0x0000000007170000-0x00000000071AC000-memory.dmp	family_redline
behavioral1/memory/4388-36-0x00000000071F0000-0x000000000722A000-memory.dmp	family_redline
behavioral1/memory/4388-42-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-44-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-100-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-98-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-94-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-92-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-90-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-89-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-86-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-84-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-82-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-80-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-78-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-76-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-72-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-70-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-68-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-66-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-64-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-62-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-60-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-56-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-54-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-52-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-50-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-48-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-46-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-96-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-74-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-58-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-40-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-38-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline
behavioral1/memory/4388-37-0x00000000071F0000-0x0000000007225000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 5 IoCs

Processes:

ki582245.exeki426909.exeki596687.exeaz762177.exebu650457.exe

pid process

4868 ki582245.exe
3976 ki426909.exe
2140 ki596687.exe
1012 az762177.exe
4388 bu650457.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

az762177.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az762177.exe

pid	process
4868	ki582245.exe
3976	ki426909.exe
2140	ki596687.exe
1012	az762177.exe
4388	bu650457.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	az762177.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exeki582245.exeki426909.exeki596687.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ki582245.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ki426909.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	ki596687.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ki426909.exeki596687.exebu650457.exe0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exeki582245.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki426909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki596687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bu650457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki582245.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

az762177.exe

pid process

1012 az762177.exe
1012 az762177.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

az762177.exebu650457.exe

description pid process

Token: SeDebugPrivilege 1012 az762177.exe
Token: SeDebugPrivilege 4388 bu650457.exe

pid	process
1012	az762177.exe
1012	az762177.exe

description	pid	process
Token: SeDebugPrivilege	1012	az762177.exe
Token: SeDebugPrivilege	4388	bu650457.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exeki582245.exeki426909.exeki596687.exe

description	pid	process	target process
PID 2616 wrote to memory of 4868	2616	0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exe	ki582245.exe
PID 2616 wrote to memory of 4868	2616	0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exe	ki582245.exe
PID 2616 wrote to memory of 4868	2616	0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exe	ki582245.exe
PID 4868 wrote to memory of 3976	4868	ki582245.exe	ki426909.exe
PID 4868 wrote to memory of 3976	4868	ki582245.exe	ki426909.exe
PID 4868 wrote to memory of 3976	4868	ki582245.exe	ki426909.exe
PID 3976 wrote to memory of 2140	3976	ki426909.exe	ki596687.exe
PID 3976 wrote to memory of 2140	3976	ki426909.exe	ki596687.exe
PID 3976 wrote to memory of 2140	3976	ki426909.exe	ki596687.exe
PID 2140 wrote to memory of 1012	2140	ki596687.exe	az762177.exe
PID 2140 wrote to memory of 1012	2140	ki596687.exe	az762177.exe
PID 2140 wrote to memory of 4388	2140	ki596687.exe	bu650457.exe
PID 2140 wrote to memory of 4388	2140	ki596687.exe	bu650457.exe
PID 2140 wrote to memory of 4388	2140	ki596687.exe	bu650457.exe

C:\Users\Admin\AppData\Local\Temp\0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exe
"C:\Users\Admin\AppData\Local\Temp\0db63d727e7306907ddad9abf98c0eda689dabfac32a0b4cee509dad3dd62a8c.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki582245.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki582245.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki426909.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki426909.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki596687.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki596687.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az762177.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az762177.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu650457.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu650457.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ki582245.exe

Filesize
929KB

MD5
98ae1a17e53faccd5f6e3538bca4bbca

SHA1
420ea4d7e68b84bf413049a822d613f906172efd

SHA256
3b9a5102d4e392ec1a942d6d44bb4c1b595167b559806d0995e3a160f4fa3ddb

SHA512
06c75998f9b5efc6a8273fe5b847469b21fbc65f9534949af0dbfad3e47f5fcf6f59426d6976c8f33e53d230d5a7408e2778f3f34752745df6a4d917baf854b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ki426909.exe

Filesize
694KB

MD5
27076a76b616cab0a80b9380ab7340e9

SHA1
2f50293cfa8560d37bf399b52649dc825865cffc

SHA256
65809eb13f11fe81b4143ee6f9b8e671d25654b63d1432f9df872b32b52f5a04

SHA512
298e373b9f21ffd137a38d4bf1232c3564980c95f00b91c3729559f0565cbe2e7104278cd7884a35d9e8f2363c3f248434cc6f96c62953a3110c3bd58ffb6d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ki596687.exe

Filesize
414KB

MD5
6f155d011f13c25dbb83c7b557ca0a23

SHA1
e9e3b2f02d9ffc8f7062a7da6e509875619014a8

SHA256
2f5a550cc6b71a341e308bcca256abda773e7a5863a025a8038c4e2139309a9a

SHA512
581d9118daad93587fa4b06d92093580ad2e33cf3185d4931ad5bf93dc754d3a2be05746ed9aee0a36d9f4018ae7df5c02c3c31eda404a83fd53664d5358d21d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az762177.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu650457.exe

Filesize
359KB

MD5
3d0e5533dcfb4bb14f18b01975ce8718

SHA1
39a53838e764fdd69d22a3166e116358785edf09

SHA256
2964d0b12f8b4fb5e4d9ec09372bad290c70005e5edfe84b6c2eec23a028acaa

SHA512
f8fc43ea147ad2c868dc6edad8e64f2ea8ca985ca590b4eac0e2ef429caada4cf68338ca8b1894c29b72a6d4dd8871cb62a0e6def88ca675df14ce909de22786

Download Submit
memory/1012-28-0x0000000000620000-0x000000000062A000-memory.dmp

Filesize
40KB

Download
memory/4388-76-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-64-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-36-0x00000000071F0000-0x000000000722A000-memory.dmp

Filesize
232KB

Download
memory/4388-42-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-44-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-100-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-98-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-94-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-92-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-90-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-89-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-86-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-84-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-82-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-80-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-78-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-34-0x0000000007170000-0x00000000071AC000-memory.dmp

Filesize
240KB

Download
memory/4388-72-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-70-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-68-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-66-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-35-0x0000000007330000-0x00000000078D4000-memory.dmp

Filesize
5.6MB

Download
memory/4388-62-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-60-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-56-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-54-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-52-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-50-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-48-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-46-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-96-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-74-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-58-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-40-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-38-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-37-0x00000000071F0000-0x0000000007225000-memory.dmp

Filesize
212KB

Download
memory/4388-829-0x0000000009D60000-0x000000000A378000-memory.dmp

Filesize
6.1MB

Download
memory/4388-830-0x00000000072E0000-0x00000000072F2000-memory.dmp

Filesize
72KB

Download
memory/4388-831-0x000000000A380000-0x000000000A48A000-memory.dmp

Filesize
1.0MB

Download
memory/4388-832-0x000000000A490000-0x000000000A4CC000-memory.dmp

Filesize
240KB

Download
memory/4388-833-0x0000000006CA0000-0x0000000006CEC000-memory.dmp

Filesize
304KB

Download