healer | f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exe
Size

659KB
MD5

d35814060e9d1011fab52627cfdb0747
SHA1

b879f8a70be76c17c8ee7d325e74cbcde5094436
SHA256

f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84
SHA512

d87ff4d52fe47614b45ff7cb5bb4db093c74f69a6e320f27c4b0fdb865b67e2b4275313e93c8e7d2dd8b9091d0e1503ee41d07be2fb7c328c0efdb5d0da8bbf3
SSDEEP

12288:KMrhy90DZ88n7haaU1pmgSxxhmz9cySshqQQXqmKjpQoqBiJi3ukM:fyeZVj6Hb6gqNQlQDPM

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4264-18-0x0000000004B00000-0x0000000004B1A000-memory.dmp	healer
behavioral1/memory/4264-20-0x00000000076C0000-0x00000000076D8000-memory.dmp	healer
behavioral1/memory/4264-48-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-46-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-45-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-42-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-40-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-38-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-36-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-34-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-32-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-30-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-28-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-26-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-24-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-22-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer
behavioral1/memory/4264-21-0x00000000076C0000-0x00000000076D2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro8212.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro8212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro8212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro8212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro8212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro8212.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro8212.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1524-60-0x0000000004A90000-0x0000000004AD6000-memory.dmp	family_redline
behavioral1/memory/1524-61-0x0000000004D50000-0x0000000004D94000-memory.dmp	family_redline
behavioral1/memory/1524-73-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-63-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-95-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-93-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-92-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-90-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-87-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-85-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-83-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-81-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-79-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-77-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-75-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-71-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-69-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-68-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-66-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline
behavioral1/memory/1524-62-0x0000000004D50000-0x0000000004D8F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un811214.exepro8212.exequ3928.exe

pid process

3120 un811214.exe
4264 pro8212.exe
1524 qu3928.exe

pid	process
3120	un811214.exe
4264	pro8212.exe
1524	qu3928.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro8212.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro8212.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro8212.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exeun811214.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un811214.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3632 4264 WerFault.exe pro8212.exe

pid	pid_target	process	target process
3632	4264	WerFault.exe	pro8212.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

qu3928.exef7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exeun811214.exepro8212.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu3928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un811214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro8212.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro8212.exe

pid process

4264 pro8212.exe
4264 pro8212.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro8212.exequ3928.exe

description pid process

Token: SeDebugPrivilege 4264 pro8212.exe
Token: SeDebugPrivilege 1524 qu3928.exe

pid	process
4264	pro8212.exe
4264	pro8212.exe

description	pid	process
Token: SeDebugPrivilege	4264	pro8212.exe
Token: SeDebugPrivilege	1524	qu3928.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exeun811214.exe

description	pid	process	target process
PID 316 wrote to memory of 3120	316	f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exe	un811214.exe
PID 316 wrote to memory of 3120	316	f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exe	un811214.exe
PID 316 wrote to memory of 3120	316	f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exe	un811214.exe
PID 3120 wrote to memory of 4264	3120	un811214.exe	pro8212.exe
PID 3120 wrote to memory of 4264	3120	un811214.exe	pro8212.exe
PID 3120 wrote to memory of 4264	3120	un811214.exe	pro8212.exe
PID 3120 wrote to memory of 1524	3120	un811214.exe	qu3928.exe
PID 3120 wrote to memory of 1524	3120	un811214.exe	qu3928.exe
PID 3120 wrote to memory of 1524	3120	un811214.exe	qu3928.exe

C:\Users\Admin\AppData\Local\Temp\f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exe
"C:\Users\Admin\AppData\Local\Temp\f7cdace7bb244486676fdaa01bfc9b70f3be617cd4f4d994396ef65f54a7da84.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:316

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un811214.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un811214.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8212.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8212.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 1020
4⤵
- Program crash
PID:3632

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3928.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3928.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4264 -ip 4264
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un811214.exe

Filesize
517KB

MD5
b16acc3ac4169e76cc500080c17f14f7

SHA1
a64906e29fc90043e6a3d1490bce0525f0be88ba

SHA256
8b8e0817e15a623a651382a8a6349bf7752e95e7af734d322157929ee278452c

SHA512
da93be1d15198cd53d08018fa7c1942b9acf4d95a8b215bd5de3bf19374201192e51e215a0f509b6eaa76e4a21f320cd7a93d9af7b808d8a7dccb173caa00d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8212.exe

Filesize
295KB

MD5
bcb72d96a0749904340f661532ed5d3c

SHA1
f2a6572c87f44df7ce6316a13ce92ed1be3a6fe5

SHA256
c85929e3ccb3032f3adbddb774ee1c78939b5b5db148c20e28e8ed968af525d5

SHA512
617a0d769732802f2e95aa3beb37421817e43c6f9def56a4981a5598040907f258151a0ec0c69365036b67d720d7af891839278d83e551d83e9a57d11f20a5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3928.exe

Filesize
354KB

MD5
e722f6002f9c059f1fb972438e24d775

SHA1
ded547b6615f01c46775f706212803c8fa12d1e7

SHA256
8680e8a604cba53bd7f6bf8d0643bd8ea6d28edf4bc54c116e9fe8448e9d70eb

SHA512
8e5cc9d90cdde5997f8c352a351ee35f49feb72cd18614d05308f02c2f9661e840c88768d7f82812831c1ee4d0cc402e87dff088ba5a471b6df17246ef1da627

Download Submit
memory/1524-77-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-81-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-969-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/1524-968-0x0000000007910000-0x0000000007F28000-memory.dmp

Filesize
6.1MB

Download
memory/1524-62-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-66-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-68-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-69-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-71-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-75-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-971-0x00000000080F0000-0x000000000812C000-memory.dmp

Filesize
240KB

Download
memory/1524-972-0x0000000008240000-0x000000000828C000-memory.dmp

Filesize
304KB

Download
memory/1524-79-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-970-0x00000000080D0000-0x00000000080E2000-memory.dmp

Filesize
72KB

Download
memory/1524-83-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-85-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-87-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-90-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-92-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-93-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-95-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-63-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-73-0x0000000004D50000-0x0000000004D8F000-memory.dmp

Filesize
252KB

Download
memory/1524-61-0x0000000004D50000-0x0000000004D94000-memory.dmp

Filesize
272KB

Download
memory/1524-60-0x0000000004A90000-0x0000000004AD6000-memory.dmp

Filesize
280KB

Download
memory/4264-38-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-54-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/4264-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4264-51-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/4264-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4264-50-0x0000000002CE0000-0x0000000002D0D000-memory.dmp

Filesize
180KB

Download
memory/4264-49-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Filesize
1024KB

Download
memory/4264-21-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-22-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-24-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-26-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-28-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-30-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-32-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-34-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-36-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-40-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-42-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-45-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-46-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-48-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/4264-20-0x00000000076C0000-0x00000000076D8000-memory.dmp

Filesize
96KB

Download
memory/4264-19-0x00000000070B0000-0x0000000007654000-memory.dmp

Filesize
5.6MB

Download
memory/4264-18-0x0000000004B00000-0x0000000004B1A000-memory.dmp

Filesize
104KB

Download
memory/4264-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4264-16-0x0000000002CE0000-0x0000000002D0D000-memory.dmp

Filesize
180KB

Download
memory/4264-15-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Filesize
1024KB

Download