healer | fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7.exe
Size

689KB
MD5

54d427f28316309696a2f174bcb04aff
SHA1

a140400ae24c2c72650b35c05cffc5419b28db49
SHA256

fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7
SHA512

bf30168cda2e5136aaa703b9e0eaf581dc8b1db1e3d7b4857950d105c148715132a394d8fbf3f98b202036b11fadaa3d17f0c9412b1c65bf720742ac98677b92
SSDEEP

12288:AMrsy90NUJjDIm8LgfQrvsdF/hoaYG9p8SN6l/ERE1xJ8EvdkPnx:8y2UJHImfQbqd6G9KSN6CRE1nkPnx

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/3460-19-0x0000000002420000-0x000000000243A000-memory.dmp	healer
behavioral1/memory/3460-21-0x0000000005380000-0x0000000005398000-memory.dmp	healer
behavioral1/memory/3460-49-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-47-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-45-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-44-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-41-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-39-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-37-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-36-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-33-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-31-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-30-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-27-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-25-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-23-0x0000000005380000-0x0000000005392000-memory.dmp	healer
behavioral1/memory/3460-22-0x0000000005380000-0x0000000005392000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro0857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro0857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro0857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro0857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro0857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro0857.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 21 IoCs

resource	yara_rule
behavioral1/memory/4124-60-0x0000000002740000-0x0000000002786000-memory.dmp	family_redline
behavioral1/memory/4124-61-0x00000000028B0000-0x00000000028F4000-memory.dmp	family_redline
behavioral1/memory/4124-65-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-83-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-95-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-93-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-91-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-89-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-87-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-82-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-79-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-80-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-77-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-75-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-73-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-71-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-69-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-67-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-85-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-63-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline
behavioral1/memory/4124-62-0x00000000028B0000-0x00000000028EF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
4372	un102557.exe
3460	pro0857.exe
4124	qu1072.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro0857.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro0857.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un102557.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	3460	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu1072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un102557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro0857.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3460	pro0857.exe
3460	pro0857.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	pro0857.exe
Token: SeDebugPrivilege	4124	qu1072.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 4372	3396	fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7.exe	84
PID 3396 wrote to memory of 4372	3396	fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7.exe	84
PID 3396 wrote to memory of 4372	3396	fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7.exe	84
PID 4372 wrote to memory of 3460	4372	un102557.exe	85
PID 4372 wrote to memory of 3460	4372	un102557.exe	85
PID 4372 wrote to memory of 3460	4372	un102557.exe	85
PID 4372 wrote to memory of 4124	4372	un102557.exe	97
PID 4372 wrote to memory of 4124	4372	un102557.exe	97
PID 4372 wrote to memory of 4124	4372	un102557.exe	97

C:\Users\Admin\AppData\Local\Temp\fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7.exe
"C:\Users\Admin\AppData\Local\Temp\fc7c312dee61abbd24c04d81a613a22873224099fb23a6d2eaef9499242ae5b7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un102557.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un102557.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0857.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0857.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 1084
      4⤵
      Program crash
      PID:3040
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1072.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1072.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3460 -ip 3460
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un102557.exe

Filesize
536KB

MD5
9a77733a56048574e15f019b4c022302

SHA1
499c40c6aa2983fe648bca086398a2aeba4bbf8a

SHA256
28ec3259920d4cf5b3d58aad576e8f5cebe84f3d018765403b8aac530e98e3e0

SHA512
2a59116a65bbb8942f5f0ccf868aefad0224de5156a3c2184f9b5a8d680ea50b9d6e25a652edc9e86946fd12f88730b8733d1825ae2d09e9a1199751b170b6a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0857.exe

Filesize
314KB

MD5
329bed755d3d27993255a6673b9f22b7

SHA1
36ae4e5bd0376a7fb61a168a1cde0fe8b058101b

SHA256
534500483da611c88bda7cb7ed3d608f05b893126d86eafb45e610ff309edd81

SHA512
9666593f26638e7950e02abc92e22fd51498579203c4d4305dd86ae2ceb5e1b91c9b49d9abb41ad51a52db04f60257bcb2ed6de6d1a8246aab97fbfb9267febe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1072.exe

Filesize
372KB

MD5
589c807bc479663795744e8a870f8ee0

SHA1
82a55d05c1ae5dcc1435308e27bd6ef7e1010864

SHA256
518ae4125507054b6db5d9731a01a4c5ea1234ebcefb03d3c59f29f09da6757c

SHA512
adddbee3735061db57f3c611d78d8f81cc7f154672e9cce63d23e495b2ecb7b493025e247077b3be06e7a25d2e05bdcac5f064bb9bd5dea08ea3de3b02f3c788

Download Submit
memory/3460-15-0x0000000000880000-0x0000000000980000-memory.dmp

Filesize
1024KB

Download
memory/3460-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3460-16-0x0000000000820000-0x000000000084D000-memory.dmp

Filesize
180KB

Download
memory/3460-18-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/3460-19-0x0000000002420000-0x000000000243A000-memory.dmp

Filesize
104KB

Download
memory/3460-20-0x0000000004DD0000-0x0000000005374000-memory.dmp

Filesize
5.6MB

Download
memory/3460-21-0x0000000005380000-0x0000000005398000-memory.dmp

Filesize
96KB

Download
memory/3460-49-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-47-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-45-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-44-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-41-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-39-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-37-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-36-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-33-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-31-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-30-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-27-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-25-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-23-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-22-0x0000000005380000-0x0000000005392000-memory.dmp

Filesize
72KB

Download
memory/3460-50-0x0000000000880000-0x0000000000980000-memory.dmp

Filesize
1024KB

Download
memory/3460-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3460-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3460-54-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/4124-60-0x0000000002740000-0x0000000002786000-memory.dmp

Filesize
280KB

Download
memory/4124-61-0x00000000028B0000-0x00000000028F4000-memory.dmp

Filesize
272KB

Download
memory/4124-65-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-83-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-95-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-93-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-91-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-89-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-87-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-82-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-79-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-80-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-77-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-75-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-73-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-71-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-69-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-67-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-85-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-63-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-62-0x00000000028B0000-0x00000000028EF000-memory.dmp

Filesize
252KB

Download
memory/4124-968-0x0000000005450000-0x0000000005A68000-memory.dmp

Filesize
6.1MB

Download
memory/4124-969-0x0000000005AF0000-0x0000000005BFA000-memory.dmp

Filesize
1.0MB

Download
memory/4124-970-0x0000000005C30000-0x0000000005C42000-memory.dmp

Filesize
72KB

Download
memory/4124-971-0x0000000005C50000-0x0000000005C8C000-memory.dmp

Filesize
240KB

Download
memory/4124-972-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Filesize
304KB

Download