healer | 158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71

Resubmissions

29-10-2024 12:12

241029-pdnz6swngp 10

02-04-2023 23:18

230402-3anrwsbe84 10

Analysis

max time kernel
144s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
29-10-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe
Size

666KB
MD5

79c42acfef4f418e432e9e9b6a31da51
SHA1

bb7537c905b5eedd84951dc2ce2bc11cbe2185ad
SHA256

158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71
SHA512

d851e28e22a4ab6d4e41c6a404a9e16f4dae6d5f409c16a640c382eeb1c108cef01a052bdd9f844a7d00b5ec367f73204517c4946b55e40e997144cf9e738e70
SSDEEP

12288:YMrqy90Jhv0JVYrjHPfQx7mq74n7DdPxCo27rU0/L/wLFk5+IR3SSc:yyANv3QxCW47DdpCZ7rFTwxkwy3nc

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral4/memory/2068-19-0x00000000027C0000-0x00000000027DA000-memory.dmp	healer
behavioral4/memory/2068-21-0x0000000002960000-0x0000000002978000-memory.dmp	healer
behavioral4/memory/2068-33-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-49-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-47-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-45-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-44-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-41-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-39-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-37-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-35-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-31-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-27-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-25-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-23-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-22-0x0000000002960000-0x0000000002972000-memory.dmp	healer
behavioral4/memory/2068-29-0x0000000002960000-0x0000000002972000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6248.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral4/memory/2640-62-0x0000000002800000-0x0000000002846000-memory.dmp	family_redline
behavioral4/memory/2640-64-0x0000000002990000-0x00000000029D4000-memory.dmp	family_redline
behavioral4/memory/2640-90-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-88-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-86-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-98-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-96-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-94-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-92-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-84-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-82-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-80-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-78-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-76-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-74-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-72-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-70-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-68-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-66-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline
behavioral4/memory/2640-65-0x0000000002990000-0x00000000029CF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
3820	un215760.exe
2068	pro6248.exe
2640	qu7671.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6248.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un215760.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4172	2068	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un215760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro6248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu7671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	pro6248.exe
2068	pro6248.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	pro6248.exe
Token: SeDebugPrivilege	2640	qu7671.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3820	4792	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	78
PID 4792 wrote to memory of 3820	4792	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	78
PID 4792 wrote to memory of 3820	4792	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	78
PID 3820 wrote to memory of 2068	3820	un215760.exe	79
PID 3820 wrote to memory of 2068	3820	un215760.exe	79
PID 3820 wrote to memory of 2068	3820	un215760.exe	79
PID 3820 wrote to memory of 2640	3820	un215760.exe	83
PID 3820 wrote to memory of 2640	3820	un215760.exe	83
PID 3820 wrote to memory of 2640	3820	un215760.exe	83

C:\Users\Admin\AppData\Local\Temp\158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe
"C:\Users\Admin\AppData\Local\Temp\158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un215760.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un215760.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6248.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6248.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 976
      4⤵
      Program crash
      PID:4172
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7671.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7671.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2068 -ip 2068
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un215760.exe

Filesize
524KB

MD5
6755745bb38839fdf65af281bd969f00

SHA1
2f30b2583e3d93a8e314fb6b226c5f52b0364908

SHA256
09166615f7e43b8a529089d6a4206421a431a7079635574a3aecefc25b316787

SHA512
8cf1e61d159c0ddc3621d452275d512d84585115fe15c7d440fefe7980c9b52aadb6a0fd8b106abfb69dac3b4aadb5ea1384c9234f47a80b162f39d3ffa28751

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6248.exe

Filesize
294KB

MD5
9f4a43f973f56c272b93f3467e932ed0

SHA1
d0e6057849e49e23196cf7f2fa09fb84862e8b8e

SHA256
5c0129a963a3b4ff5857aff4ed1b732eb0cab3d9448049cca2bd2afad4ddee1f

SHA512
eda601937fc2ff739fbeaa8219c0b9077ec73bdc2ca698116ac5a46e127167aadbd025e9ce8fe83c47078f33caf39774caca91a6669ac1e0750add650531f465

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7671.exe

Filesize
352KB

MD5
618f6727e66ea87de6664ed6a989f81b

SHA1
e746378f2de3712225f2845834317d093085708f

SHA256
7880157d41d14177ee0e91874d91de189acac98ffbd0c8fb05ca1919ae233247

SHA512
93b0ca94f646b0650245e980a46d7b3aff643b4221150ecfdc9ed95471db445a6f0f503f106461b39ef83f607e665833c8ac24cf29063b8f6a0a0e807554b27c

Download Submit
memory/2068-55-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/2068-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2068-15-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/2068-19-0x00000000027C0000-0x00000000027DA000-memory.dmp

Filesize
104KB

Download
memory/2068-20-0x0000000004FB0000-0x0000000005556000-memory.dmp

Filesize
5.6MB

Download
memory/2068-21-0x0000000002960000-0x0000000002978000-memory.dmp

Filesize
96KB

Download
memory/2068-33-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-49-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-47-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-45-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-44-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-41-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-39-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-37-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-35-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-31-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-27-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-25-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-23-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-22-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-29-0x0000000002960000-0x0000000002972000-memory.dmp

Filesize
72KB

Download
memory/2068-50-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/2068-51-0x0000000000B40000-0x0000000000B6D000-memory.dmp

Filesize
180KB

Download
memory/2068-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2068-16-0x0000000000B40000-0x0000000000B6D000-memory.dmp

Filesize
180KB

Download
memory/2068-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2068-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/2640-971-0x0000000005730000-0x0000000005D48000-memory.dmp

Filesize
6.1MB

Download
memory/2640-72-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-61-0x0000000000400000-0x000000000080C000-memory.dmp

Filesize
4.0MB

Download
memory/2640-64-0x0000000002990000-0x00000000029D4000-memory.dmp

Filesize
272KB

Download
memory/2640-90-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-88-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-86-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-98-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-96-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-94-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-92-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-84-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-82-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-80-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-78-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-76-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-74-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-62-0x0000000002800000-0x0000000002846000-memory.dmp

Filesize
280KB

Download
memory/2640-70-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-68-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-66-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-65-0x0000000002990000-0x00000000029CF000-memory.dmp

Filesize
252KB

Download
memory/2640-63-0x0000000000400000-0x000000000080C000-memory.dmp

Filesize
4.0MB

Download
memory/2640-972-0x0000000005010000-0x000000000511A000-memory.dmp

Filesize
1.0MB

Download
memory/2640-973-0x0000000002BA0000-0x0000000002BB2000-memory.dmp

Filesize
72KB

Download
memory/2640-974-0x0000000005120000-0x000000000515C000-memory.dmp

Filesize
240KB

Download
memory/2640-975-0x0000000005E50000-0x0000000005E9C000-memory.dmp

Filesize
304KB

Download