healer | 92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exe
Size

659KB
MD5

e69899ea44bed00ccb2a5552ddaf4007
SHA1

1e3c42a20babbaff2504a56bab1dfb70459b7645
SHA256

92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b
SHA512

d573063b673e51effb5805903a75e18b45348f46bef24af53fdd332be6be7f80f86e3ac5186403d90980df2529ad75de67f0609c660d71e46209195c8e959371
SSDEEP

12288:TMray90lJRXj8Z4BGd1xfAL4d5QstKsJ4FNR:VyYRXYiByxYL40stKsoR

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5096-19-0x0000000002250000-0x000000000226A000-memory.dmp	healer
behavioral1/memory/5096-21-0x0000000002350000-0x0000000002368000-memory.dmp	healer
behavioral1/memory/5096-22-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-27-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-49-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-48-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-45-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-43-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-41-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-40-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-37-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-34-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-31-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-29-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-25-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-23-0x0000000002350000-0x0000000002362000-memory.dmp	healer
behavioral1/memory/5096-35-0x0000000002350000-0x0000000002362000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro8468.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro8468.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro8468.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro8468.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro8468.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro8468.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro8468.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2716-60-0x0000000004A10000-0x0000000004A56000-memory.dmp	family_redline
behavioral1/memory/2716-61-0x0000000004A90000-0x0000000004AD4000-memory.dmp	family_redline
behavioral1/memory/2716-63-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-73-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-71-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-69-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-67-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-65-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-95-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-85-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-93-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-91-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-89-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-87-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-83-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-81-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-79-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-77-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/2716-75-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un633431.exepro8468.exequ0603.exe

pid process

4284 un633431.exe
5096 pro8468.exe
2716 qu0603.exe

pid	process
4284	un633431.exe
5096	pro8468.exe
2716	qu0603.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro8468.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro8468.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro8468.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exeun633431.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un633431.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5116 5096 WerFault.exe pro8468.exe

pid	pid_target	process	target process
5116	5096	WerFault.exe	pro8468.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exeun633431.exepro8468.exequ0603.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un633431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro8468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu0603.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro8468.exe

pid process

5096 pro8468.exe
5096 pro8468.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro8468.exequ0603.exe

description pid process

Token: SeDebugPrivilege 5096 pro8468.exe
Token: SeDebugPrivilege 2716 qu0603.exe

pid	process
5096	pro8468.exe
5096	pro8468.exe

description	pid	process
Token: SeDebugPrivilege	5096	pro8468.exe
Token: SeDebugPrivilege	2716	qu0603.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exeun633431.exe

description	pid	process	target process
PID 1924 wrote to memory of 4284	1924	92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exe	un633431.exe
PID 1924 wrote to memory of 4284	1924	92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exe	un633431.exe
PID 1924 wrote to memory of 4284	1924	92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exe	un633431.exe
PID 4284 wrote to memory of 5096	4284	un633431.exe	pro8468.exe
PID 4284 wrote to memory of 5096	4284	un633431.exe	pro8468.exe
PID 4284 wrote to memory of 5096	4284	un633431.exe	pro8468.exe
PID 4284 wrote to memory of 2716	4284	un633431.exe	qu0603.exe
PID 4284 wrote to memory of 2716	4284	un633431.exe	qu0603.exe
PID 4284 wrote to memory of 2716	4284	un633431.exe	qu0603.exe

C:\Users\Admin\AppData\Local\Temp\92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exe
"C:\Users\Admin\AppData\Local\Temp\92897d9cddb63d1d552855a4763bed2744e07803b289b8177d4ca34b4ee9d91b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un633431.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un633431.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8468.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8468.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1084
4⤵
- Program crash
PID:5116

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0603.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0603.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5096 -ip 5096
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un633431.exe

Filesize
517KB

MD5
1745348d7a245a79bd43b6a525693282

SHA1
bc0cc8f92e304dfbe68157d87973278f0e86d48c

SHA256
67959b1f0d06e9a6fbe271a60664a9921ebc3d841d6d06894697eb72c1391d1c

SHA512
c87502ac30594642431442a48e88077ec6a9a62b32bd5e007e83accb651bd7eb826a37c8764cdb7d0f9224722b8e26887b12cd0aed7f12f049a169b1f363bc86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8468.exe

Filesize
237KB

MD5
f25c2de40ac14368a59150483f119d13

SHA1
20253ee9132469972d98479369564668f4fc94f0

SHA256
2f8822b166f338af3c5843414b194e161d7cafe87d5c8ceb040d485899419452

SHA512
a7e42ef2042f2fb133293861b1bf430da62a30e80d954cb3c3d3af3e62a49970b849e45c1c69bb7b4f20cef1753ba5707f3c9189e032c14d0023cedd51ba75d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0603.exe

Filesize
295KB

MD5
6ee301bc4c584cef72361e68e9414683

SHA1
530ccca590b2edc669b15f3a3f6a8723a0a4c3a6

SHA256
f2f19e681a356f370fadf782c6404776d9cc994e1ce8836fe3a725d9f67b9418

SHA512
a7f0447892378014f1bebf64215829412b451c16c4e8ad0fab04b05767fe4016ffd005cd761cd589a5f04326a73906a58af22429954f65f962f65a3cdd206219

Download Submit
memory/2716-89-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-93-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-969-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/2716-968-0x00000000050F0000-0x0000000005708000-memory.dmp

Filesize
6.1MB

Download
memory/2716-75-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-77-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-79-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-81-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-83-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-87-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-971-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/2716-972-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download
memory/2716-91-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-970-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/2716-85-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-95-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-65-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-67-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-69-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-71-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-73-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-62-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-63-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/2716-61-0x0000000004A90000-0x0000000004AD4000-memory.dmp

Filesize
272KB

Download
memory/2716-60-0x0000000004A10000-0x0000000004A56000-memory.dmp

Filesize
280KB

Download
memory/5096-45-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5096-54-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/5096-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5096-50-0x0000000000810000-0x0000000000910000-memory.dmp

Filesize
1024KB

Download
memory/5096-35-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-23-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-25-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-29-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-31-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-34-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-37-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-40-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-41-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-43-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-48-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-49-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-27-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-22-0x0000000002350000-0x0000000002362000-memory.dmp

Filesize
72KB

Download
memory/5096-21-0x0000000002350000-0x0000000002368000-memory.dmp

Filesize
96KB

Download
memory/5096-20-0x0000000004CA0000-0x0000000005244000-memory.dmp

Filesize
5.6MB

Download
memory/5096-19-0x0000000002250000-0x000000000226A000-memory.dmp

Filesize
104KB

Download
memory/5096-18-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/5096-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5096-17-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/5096-15-0x0000000000810000-0x0000000000910000-memory.dmp

Filesize
1024KB

Download