healer | fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exe
Size

690KB
MD5

9bf0ca064d5fd294fe23265468ff6756
SHA1

0694b3a590454a9792780b45dac8e4067df1c9d1
SHA256

fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3
SHA512

c33c5ff713dba49acd9b6ec57b465279b7912b6d8e3d137a61b3f7ff96d4542622fb4df862bd4192c9889092ec6d7f941aa9d976d1e5128a6698ea09755e855c
SSDEEP

12288:mMrqy9038QOWOUKmQbK08soK2hlv4R8ETfCflbeoUZhSsefEbGsb:QyPQCmQWK2z6m1WDqEBb

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2720-19-0x00000000028B0000-0x00000000028CA000-memory.dmp	healer
behavioral1/memory/2720-21-0x0000000004DA0000-0x0000000004DB8000-memory.dmp	healer
behavioral1/memory/2720-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-22-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-47-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-39-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-27-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-25-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer
behavioral1/memory/2720-23-0x0000000004DA0000-0x0000000004DB2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro7268.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro7268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro7268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro7268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro7268.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro7268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro7268.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4208-60-0x00000000027B0000-0x00000000027F6000-memory.dmp	family_redline
behavioral1/memory/4208-61-0x0000000004E50000-0x0000000004E94000-memory.dmp	family_redline
behavioral1/memory/4208-73-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-75-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-71-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-69-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-67-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-95-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-65-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-63-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-62-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-93-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-91-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-90-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-87-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-85-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-83-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-81-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-79-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline
behavioral1/memory/4208-77-0x0000000004E50000-0x0000000004E8F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un263836.exepro7268.exequ5799.exe

pid process

1548 un263836.exe
2720 pro7268.exe
4208 qu5799.exe

pid	process
1548	un263836.exe
2720	pro7268.exe
4208	qu5799.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro7268.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro7268.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro7268.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exeun263836.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un263836.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4640 2720 WerFault.exe pro7268.exe

pid	pid_target	process	target process
4640	2720	WerFault.exe	pro7268.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exeun263836.exepro7268.exequ5799.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un263836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro7268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu5799.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro7268.exe

pid process

2720 pro7268.exe
2720 pro7268.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro7268.exequ5799.exe

description pid process

Token: SeDebugPrivilege 2720 pro7268.exe
Token: SeDebugPrivilege 4208 qu5799.exe

pid	process
2720	pro7268.exe
2720	pro7268.exe

description	pid	process
Token: SeDebugPrivilege	2720	pro7268.exe
Token: SeDebugPrivilege	4208	qu5799.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exeun263836.exe

description	pid	process	target process
PID 4288 wrote to memory of 1548	4288	fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exe	un263836.exe
PID 4288 wrote to memory of 1548	4288	fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exe	un263836.exe
PID 4288 wrote to memory of 1548	4288	fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exe	un263836.exe
PID 1548 wrote to memory of 2720	1548	un263836.exe	pro7268.exe
PID 1548 wrote to memory of 2720	1548	un263836.exe	pro7268.exe
PID 1548 wrote to memory of 2720	1548	un263836.exe	pro7268.exe
PID 1548 wrote to memory of 4208	1548	un263836.exe	qu5799.exe
PID 1548 wrote to memory of 4208	1548	un263836.exe	qu5799.exe
PID 1548 wrote to memory of 4208	1548	un263836.exe	qu5799.exe

C:\Users\Admin\AppData\Local\Temp\fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exe
"C:\Users\Admin\AppData\Local\Temp\fb8ec5612955f90b8a9313d5c4d5ed49c4cd86e9874214df9973841e700770e3.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un263836.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un263836.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7268.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7268.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 1080
4⤵
- Program crash
PID:4640

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5799.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5799.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2720 -ip 2720
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un263836.exe

Filesize
536KB

MD5
289aed8633a1caa2ee89b7c8d8cab0b9

SHA1
45b116223cce3639283bd98a8e0232aba9fa8675

SHA256
65b30f05bf6e03c1674d91a0675d3f21577942d143af0989a5babd61e1e53401

SHA512
04c923f2b75b4da14317856fb43b55b7b896a816182c53b79d17acae245160dfbfb92a64145696ea9502d191d97bba99d3e482b3560cdb723f71f4fee6178784

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7268.exe

Filesize
312KB

MD5
b67d9a3734e7bc3bb25fc9b0184e6f9d

SHA1
c0c1bff10f345c572102afd7b187b3198154345e

SHA256
baf795d7f4d96c038905ca2e7f0edf93049d7eb353d4885ad63004f7e5214ff3

SHA512
33a952cfd08534ea21de85a8d4eb132d9baacfea0911ab2da9914592c7dd03bd947f88d9a3c8e77c2bd48ec744100cfe978b2df1d94fed29067fa94ee84841a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5799.exe

Filesize
370KB

MD5
8b1bde8d8e0d5ce055190fee25a47c72

SHA1
20cdf1059d0edc5a83dbbcd0ba65ae447c08ed9d

SHA256
f6e811e5db1122a59a4ae55b2e83f09673febd1a5678a06e3682ac4282e877a0

SHA512
c7036a13999098053238aa8a6a7a76f3de710379d33e8cbbded2b0678e2c12e48057b91bdb4c8c82275ec523982c0436461c0d08e138e3db0df013d6c4f0f8d4

Download Submit
memory/2720-15-0x0000000000970000-0x0000000000A70000-memory.dmp

Filesize
1024KB

Download
memory/2720-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2720-17-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2720-18-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2720-19-0x00000000028B0000-0x00000000028CA000-memory.dmp

Filesize
104KB

Download
memory/2720-20-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/2720-21-0x0000000004DA0000-0x0000000004DB8000-memory.dmp

Filesize
96KB

Download
memory/2720-49-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-22-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-47-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-45-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-43-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-41-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-39-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-37-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-35-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-33-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-31-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-29-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-27-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-25-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-23-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/2720-50-0x0000000000970000-0x0000000000A70000-memory.dmp

Filesize
1024KB

Download
memory/2720-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2720-54-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/2720-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4208-60-0x00000000027B0000-0x00000000027F6000-memory.dmp

Filesize
280KB

Download
memory/4208-61-0x0000000004E50000-0x0000000004E94000-memory.dmp

Filesize
272KB

Download
memory/4208-73-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-75-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-71-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-69-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-67-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-95-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-65-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-63-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-62-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-93-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-91-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-90-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-87-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-85-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-83-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-81-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-79-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-77-0x0000000004E50000-0x0000000004E8F000-memory.dmp

Filesize
252KB

Download
memory/4208-968-0x0000000005550000-0x0000000005B68000-memory.dmp

Filesize
6.1MB

Download
memory/4208-969-0x0000000005B70000-0x0000000005C7A000-memory.dmp

Filesize
1.0MB

Download
memory/4208-970-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/4208-971-0x0000000005C80000-0x0000000005CBC000-memory.dmp

Filesize
240KB

Download
memory/4208-972-0x0000000005DC0000-0x0000000005E0C000-memory.dmp

Filesize
304KB

Download