healer | bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b.exe
Size

972KB
MD5

da9600aaff40b88412275eda037532c0
SHA1

7d40e947e7e6ecaf6d22da4445ed250e29240798
SHA256

bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b
SHA512

91d3eaf7e874ed46d605ba81ad8ec4375f193feb5352131a03337e0dd706cec331551db7eb07c29f43c7e7964391188c9a728e15cde6e08cff2991fa83f3fff1
SSDEEP

24576:uyAt/PTA9ZH5Pu7F5LWCRWlnfCLuqG1XJ2rjDJ8if:9cs9ZZPu7FhWSqGuTWnDf

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/2416-22-0x00000000027C0000-0x00000000027DA000-memory.dmp	healer
behavioral1/memory/2416-24-0x00000000029D0000-0x00000000029E8000-memory.dmp	healer
behavioral1/memory/2416-25-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-52-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-50-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-48-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-46-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-44-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-42-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-40-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-38-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-36-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-34-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-32-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-30-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-28-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer
behavioral1/memory/2416-26-0x00000000029D0000-0x00000000029E2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr161666.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr161666.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr161666.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr161666.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr161666.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr161666.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3792-60-0x00000000028A0000-0x00000000028E6000-memory.dmp	family_redline
behavioral1/memory/3792-61-0x00000000053C0000-0x0000000005404000-memory.dmp	family_redline
behavioral1/memory/3792-75-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-85-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-95-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-93-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-91-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-89-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-87-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-83-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-81-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-79-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-77-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-73-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-71-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-69-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-67-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-65-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-63-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline
behavioral1/memory/3792-62-0x00000000053C0000-0x00000000053FF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

pid	Process
4636	un384792.exe
396	un311944.exe
2416	pr161666.exe
3792	qu395829.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr161666.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr161666.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un384792.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un311944.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4744	2416	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pr161666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu395829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un384792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un311944.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	pr161666.exe
2416	pr161666.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	pr161666.exe
Token: SeDebugPrivilege	3792	qu395829.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4636	4528	bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b.exe	86
PID 4528 wrote to memory of 4636	4528	bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b.exe	86
PID 4528 wrote to memory of 4636	4528	bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b.exe	86
PID 4636 wrote to memory of 396	4636	un384792.exe	87
PID 4636 wrote to memory of 396	4636	un384792.exe	87
PID 4636 wrote to memory of 396	4636	un384792.exe	87
PID 396 wrote to memory of 2416	396	un311944.exe	88
PID 396 wrote to memory of 2416	396	un311944.exe	88
PID 396 wrote to memory of 2416	396	un311944.exe	88
PID 396 wrote to memory of 3792	396	un311944.exe	99
PID 396 wrote to memory of 3792	396	un311944.exe	99
PID 396 wrote to memory of 3792	396	un311944.exe	99

C:\Users\Admin\AppData\Local\Temp\bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b.exe
"C:\Users\Admin\AppData\Local\Temp\bcef5f572ab9fbfba3f765334bd671ad155839e666cf42a03566d63e305a4b2b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384792.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384792.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un311944.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un311944.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr161666.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr161666.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2416
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1092
        5⤵
        Program crash
        
        PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu395829.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu395829.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2416 -ip 2416
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384792.exe

Filesize
682KB

MD5
9b7408d447f8d3a4b802f196593f42f8

SHA1
7d4c0b3d7b55233e0a721eb03cc52d6ef6088e25

SHA256
70bbe04f84e1eafe926f47075360fa211db6ef05cb9b7f5f3fc97df2bef3add9

SHA512
072782d2c5888f16d73d252b4b2c40c56061ba6511f910e8d3388e780d4f193aef0faf7f003a4e291fa3954efbbf21012062301928159b3723e66611fb41360d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un311944.exe

Filesize
540KB

MD5
153f01d07e8126a4d651a1fff7e930ca

SHA1
45f0a90fb2a883dbec0e5a107ddfd9479a66041a

SHA256
fc15817b30c87b1a9f0f95fffec3aec3a53491fa599e62b207708be2eda15995

SHA512
b9064c6f9a12611e8666747ea8523d413b0d2307090faefc3fe0d4d865bbfbde300cbcfd809c493bd455a3ed6d10c4267d2b97d47930e1e9ceec0032c33abd58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr161666.exe

Filesize
352KB

MD5
d7026194030d420d426532d3231c7a63

SHA1
9e459cdc530ed2d9806c1021d632427a658a12c3

SHA256
1f282985aa9f560e7f4ae10b6f84237caccbf655cdd3408b1ba30c250efce965

SHA512
8c323d7d35108f181eb3d5cc8d47494f91e435f1769f7176505eb23037b71af49db7be13c02f070dd224b5dd15673eb43a1c68f467aa52533d092c206532fb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu395829.exe

Filesize
411KB

MD5
7be316a49a602587fce88cb6a8ce704b

SHA1
dcc8f05b92ca80f046dd1fb99521385ab20887bf

SHA256
208d1bd324cd7b96644756c01cb798b6dfd6ea8bcd701fe0ea47d896180bee66

SHA512
ba3231c76bb904c3e402d143239e822113a84a1cfcb9d74eb977c9cc7733fd908a65181937b458b873a2ea54b154e0cb8d9a88989de296580daad6991e385b24

Download Submit
memory/2416-42-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-40-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-25-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-52-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-50-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-48-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-46-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-44-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-23-0x0000000005130000-0x00000000056D4000-memory.dmp

Filesize
5.6MB

Download
memory/2416-24-0x00000000029D0000-0x00000000029E8000-memory.dmp

Filesize
96KB

Download
memory/2416-38-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-36-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-34-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-32-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-30-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-28-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-26-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/2416-53-0x0000000000400000-0x00000000007F7000-memory.dmp

Filesize
4.0MB

Download
memory/2416-55-0x0000000000400000-0x00000000007F7000-memory.dmp

Filesize
4.0MB

Download
memory/2416-22-0x00000000027C0000-0x00000000027DA000-memory.dmp

Filesize
104KB

Download
memory/3792-60-0x00000000028A0000-0x00000000028E6000-memory.dmp

Filesize
280KB

Download
memory/3792-61-0x00000000053C0000-0x0000000005404000-memory.dmp

Filesize
272KB

Download
memory/3792-75-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-85-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-95-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-93-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-91-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-89-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-87-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-83-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-81-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-79-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-77-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-73-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-71-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-69-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-67-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-65-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-63-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-62-0x00000000053C0000-0x00000000053FF000-memory.dmp

Filesize
252KB

Download
memory/3792-968-0x0000000005440000-0x0000000005A58000-memory.dmp

Filesize
6.1MB

Download
memory/3792-969-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

Filesize
1.0MB

Download
memory/3792-970-0x0000000005C20000-0x0000000005C32000-memory.dmp

Filesize
72KB

Download
memory/3792-971-0x0000000005C40000-0x0000000005C7C000-memory.dmp

Filesize
240KB

Download
memory/3792-972-0x0000000005DD0000-0x0000000005E1C000-memory.dmp

Filesize
304KB

Download