healer | 70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exe
Size

659KB
MD5

6e73f036e9c1d3f20b24d4643677977e
SHA1

da1335b5903e633ca8ab01a3bd343a939974a61a
SHA256

70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d
SHA512

b3a2db5f5ccf97bf959fe6b686517e36348f4c088480cba12cd40252de75ead6bd3d78eaa00ede60cc44cec46f6fe42d19413d02a42e9f7fb7523ecd1a4530ff
SSDEEP

12288:ZMrsy90ZywSBRilsVRAxpYi+UDSMDssREAd/fybJRt3MvISRUAMJ:9yTwGVRAxpNSJkyVMvXRIJ

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4284-17-0x0000000004910000-0x000000000492A000-memory.dmp	healer
behavioral1/memory/4284-20-0x0000000004BC0000-0x0000000004BD8000-memory.dmp	healer
behavioral1/memory/4284-40-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-48-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-46-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-44-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-42-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-38-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-36-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-34-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-32-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-30-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-28-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-26-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-24-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-22-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/4284-21-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro2152.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2152.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2152.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4700-59-0x0000000004C20000-0x0000000004C66000-memory.dmp	family_redline
behavioral1/memory/4700-60-0x0000000004E30000-0x0000000004E74000-memory.dmp	family_redline
behavioral1/memory/4700-94-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-92-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-90-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-88-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-86-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-84-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-82-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-80-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-78-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-76-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-74-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-72-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-70-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-68-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-66-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-64-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-62-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline
behavioral1/memory/4700-61-0x0000000004E30000-0x0000000004E6F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un888558.exepro2152.exequ1412.exe

pid process

3568 un888558.exe
4284 pro2152.exe
4700 qu1412.exe

pid	process
3568	un888558.exe
4284	pro2152.exe
4700	qu1412.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro2152.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro2152.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2152.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exeun888558.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un888558.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2308 4284 WerFault.exe pro2152.exe

pid	pid_target	process	target process
2308	4284	WerFault.exe	pro2152.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exeun888558.exepro2152.exequ1412.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un888558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro2152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu1412.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro2152.exe

pid process

4284 pro2152.exe
4284 pro2152.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro2152.exequ1412.exe

description pid process

Token: SeDebugPrivilege 4284 pro2152.exe
Token: SeDebugPrivilege 4700 qu1412.exe

pid	process
4284	pro2152.exe
4284	pro2152.exe

description	pid	process
Token: SeDebugPrivilege	4284	pro2152.exe
Token: SeDebugPrivilege	4700	qu1412.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exeun888558.exe

description	pid	process	target process
PID 3644 wrote to memory of 3568	3644	70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exe	un888558.exe
PID 3644 wrote to memory of 3568	3644	70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exe	un888558.exe
PID 3644 wrote to memory of 3568	3644	70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exe	un888558.exe
PID 3568 wrote to memory of 4284	3568	un888558.exe	pro2152.exe
PID 3568 wrote to memory of 4284	3568	un888558.exe	pro2152.exe
PID 3568 wrote to memory of 4284	3568	un888558.exe	pro2152.exe
PID 3568 wrote to memory of 4700	3568	un888558.exe	qu1412.exe
PID 3568 wrote to memory of 4700	3568	un888558.exe	qu1412.exe
PID 3568 wrote to memory of 4700	3568	un888558.exe	qu1412.exe

C:\Users\Admin\AppData\Local\Temp\70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exe
"C:\Users\Admin\AppData\Local\Temp\70a289d125856ef08a20baf25a92eb21bc04686562ca5da47e451a90ffaaa12d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un888558.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un888558.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2152.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2152.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 236
4⤵
- Program crash
PID:2308

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1412.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1412.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4284 -ip 4284
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un888558.exe

Filesize
517KB

MD5
7372e9172c22d8425995cd2039eef719

SHA1
5d78585cb36b35bb106632c187b17188b4d095ce

SHA256
17801c22058dacdc43a7c87375f102a8f40e1d47ca95da98862d65106cc3cd3c

SHA512
d38677c6096507f51af11c6d663c5f1168efd0bb2a6665cd99cccd61746d2e837c24a27b3d0bf2f5979e9dd98836b7c7a0ae8a7e90ff905d93f1eebf47362a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2152.exe

Filesize
296KB

MD5
de63584b3f7cd04cf940055c2af98644

SHA1
34962eae2d7558c9bafdef8616af58deb963897d

SHA256
d8859ba2b58b42fbb3e5dd5867d74fe400191173a86e362628b48c2efb5f4130

SHA512
8c8bf0f41f3918b3f6821e6147b83d403150c8b8092a56137c11bb92702926dcf78331b1ed58a59fccdb8bc177a1d5965711014db2cee9caa406706e3f1b9ce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1412.exe

Filesize
355KB

MD5
6d93ad7a6049f1b4f4b9c2dda12078ea

SHA1
8665cc669e6970ab5d2f0f00eb18ace0b9832c24

SHA256
5a5957dec4f2f17a35ebd0e746cba4eb20f7554d0f70bf0d6fb811d3711d51a3

SHA512
abc453ecb8b1e99b552c4d556123e8866c089cd1ffb081e1d33f2abe0f21d595de67d30971a472bb068ada6bb8ebe062d68841f626c93485784406f0bfb98992

Download Submit
memory/4284-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4284-15-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/4284-17-0x0000000004910000-0x000000000492A000-memory.dmp

Filesize
104KB

Download
memory/4284-18-0x00000000072D0000-0x0000000007874000-memory.dmp

Filesize
5.6MB

Download
memory/4284-20-0x0000000004BC0000-0x0000000004BD8000-memory.dmp

Filesize
96KB

Download
memory/4284-19-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/4284-40-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-48-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-46-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-44-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-42-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-38-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-36-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-34-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-32-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-30-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-28-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-26-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-24-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-22-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-21-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4284-49-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/4284-50-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4284-51-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/4284-53-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/4284-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4700-59-0x0000000004C20000-0x0000000004C66000-memory.dmp

Filesize
280KB

Download
memory/4700-60-0x0000000004E30000-0x0000000004E74000-memory.dmp

Filesize
272KB

Download
memory/4700-94-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-92-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-90-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-88-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-86-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-84-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-82-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-80-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-78-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-76-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-74-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-72-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-70-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-68-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-66-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-64-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-62-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-61-0x0000000004E30000-0x0000000004E6F000-memory.dmp

Filesize
252KB

Download
memory/4700-967-0x0000000007850000-0x0000000007E68000-memory.dmp

Filesize
6.1MB

Download
memory/4700-968-0x0000000007E70000-0x0000000007F7A000-memory.dmp

Filesize
1.0MB

Download
memory/4700-969-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/4700-970-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

Filesize
240KB

Download
memory/4700-971-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download