healer | 6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exe
Size

658KB
MD5

0a9cc72bd813113746fe30d5d09e62ce
SHA1

b27f2e1eb988570812f28802e5380707e93c14bd
SHA256

6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128
SHA512

b56838298ae2d6df6ed33bca2c099d08262f066ccf72700970a9448cbd0e5d44db4e4545b498e17f89509f16194b709b2598e6db2078bb3cccea8149523da728
SSDEEP

12288:IMrUy90J70DjLbK0Yn2C9vR3NQCaTRP3KCvK/qiku2GgiG96gzg/EVeaOKBtwJUu:My64/bTYn2CdQH1S/qiF2Ggr97/5OKBQ

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2268-19-0x0000000002590000-0x00000000025AA000-memory.dmp	healer
behavioral1/memory/2268-21-0x0000000002770000-0x0000000002788000-memory.dmp	healer
behavioral1/memory/2268-37-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-49-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-47-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-45-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-43-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-41-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-39-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-35-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-33-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-31-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-29-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-27-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-25-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-23-0x0000000002770000-0x0000000002782000-memory.dmp	healer
behavioral1/memory/2268-22-0x0000000002770000-0x0000000002782000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro0915.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro0915.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro0915.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro0915.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro0915.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro0915.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro0915.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4504-61-0x00000000025C0000-0x0000000002606000-memory.dmp	family_redline
behavioral1/memory/4504-62-0x0000000002890000-0x00000000028D4000-memory.dmp	family_redline
behavioral1/memory/4504-66-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-78-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-96-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-94-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-92-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-88-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-86-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-84-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-83-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-76-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-74-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-72-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-70-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-68-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-90-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-80-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-64-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline
behavioral1/memory/4504-63-0x0000000002890000-0x00000000028CF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un961563.exepro0915.exequ3871.exe

pid process

1128 un961563.exe
2268 pro0915.exe
4504 qu3871.exe

pid	process
1128	un961563.exe
2268	pro0915.exe
4504	qu3871.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro0915.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro0915.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro0915.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exeun961563.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un961563.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

6460 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4860 2268 WerFault.exe pro0915.exe

pid	process
6460	sc.exe

pid	pid_target	process	target process
4860	2268	WerFault.exe	pro0915.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exeun961563.exepro0915.exequ3871.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un961563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro0915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu3871.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro0915.exe

pid process

2268 pro0915.exe
2268 pro0915.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro0915.exequ3871.exe

description pid process

Token: SeDebugPrivilege 2268 pro0915.exe
Token: SeDebugPrivilege 4504 qu3871.exe

pid	process
2268	pro0915.exe
2268	pro0915.exe

description	pid	process
Token: SeDebugPrivilege	2268	pro0915.exe
Token: SeDebugPrivilege	4504	qu3871.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exeun961563.exe

description	pid	process	target process
PID 2368 wrote to memory of 1128	2368	6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exe	un961563.exe
PID 2368 wrote to memory of 1128	2368	6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exe	un961563.exe
PID 2368 wrote to memory of 1128	2368	6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exe	un961563.exe
PID 1128 wrote to memory of 2268	1128	un961563.exe	pro0915.exe
PID 1128 wrote to memory of 2268	1128	un961563.exe	pro0915.exe
PID 1128 wrote to memory of 2268	1128	un961563.exe	pro0915.exe
PID 1128 wrote to memory of 4504	1128	un961563.exe	qu3871.exe
PID 1128 wrote to memory of 4504	1128	un961563.exe	qu3871.exe
PID 1128 wrote to memory of 4504	1128	un961563.exe	qu3871.exe

C:\Users\Admin\AppData\Local\Temp\6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exe
"C:\Users\Admin\AppData\Local\Temp\6508fd789b17d059e359f53dbfc351070c07327c91c8cbe34bedc66266fd7128.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un961563.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un961563.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0915.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0915.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1080
4⤵
- Program crash
PID:4860

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3871.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3871.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2268 -ip 2268
1⤵
PID:3272

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:6460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un961563.exe

Filesize
516KB

MD5
a599be847e193fbb69a5c2d209907fcb

SHA1
f55d67f270874c512d0aaa6edd9c524464d266d2

SHA256
b017c6f6556f9bb521a86debb6e7cb016f2c63f239ba5f57bfafc2339af3da73

SHA512
8bb5252403c2e0ba8a4d3c26753b640938da5c248575369b5a6d05976dd02bce3eb9ef62b3915dbcc16d098f231f4b82cd80d3396055034f9db199a3d30bfe6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0915.exe

Filesize
295KB

MD5
cc3aec49560a4f9e6ed4800c1b6354f1

SHA1
b86b6a2bfbc3e05c00e1207b312604e45eb94080

SHA256
716595b335127b0794ec34ebe2d78e2e393a8fbda5de4138be529ca584baa8e8

SHA512
912ae3a55d7176b4631802599017dfd930373e602d42c7417ea05f05965e675a975cda8edfe95fa34af05b0621d8f5f404add558ad7b2f9ad14df0d39a880f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3871.exe

Filesize
353KB

MD5
68b44ac6b88a9a04acb7f901f80480c3

SHA1
6328ad843167c375e2c0d98a26e8bdc919968a99

SHA256
3bf17312022e5e18084be09bea73f283391034d1f078765dbfa6e6224723b00d

SHA512
ff3836d963829a332ae126921597a58cd41d36125d797dd548afd94328426cbdef144fd528eca834bac1d6cec57a48f6088cad16ec67584bae27d18dc6207872

Download Submit
memory/2268-15-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download
memory/2268-16-0x0000000002450000-0x000000000247D000-memory.dmp

Filesize
180KB

Download
memory/2268-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2268-18-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/2268-19-0x0000000002590000-0x00000000025AA000-memory.dmp

Filesize
104KB

Download
memory/2268-20-0x0000000004E80000-0x0000000005424000-memory.dmp

Filesize
5.6MB

Download
memory/2268-21-0x0000000002770000-0x0000000002788000-memory.dmp

Filesize
96KB

Download
memory/2268-37-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-49-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-47-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-45-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-43-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-41-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-39-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-35-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-33-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-31-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-29-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-27-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-25-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-23-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-22-0x0000000002770000-0x0000000002782000-memory.dmp

Filesize
72KB

Download
memory/2268-50-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download
memory/2268-51-0x0000000002450000-0x000000000247D000-memory.dmp

Filesize
180KB

Download
memory/2268-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2268-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2268-55-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4504-61-0x00000000025C0000-0x0000000002606000-memory.dmp

Filesize
280KB

Download
memory/4504-62-0x0000000002890000-0x00000000028D4000-memory.dmp

Filesize
272KB

Download
memory/4504-66-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-78-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-96-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-94-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-92-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-88-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-86-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-84-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-83-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-76-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-74-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-72-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-70-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-68-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-90-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-80-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-64-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-63-0x0000000002890000-0x00000000028CF000-memory.dmp

Filesize
252KB

Download
memory/4504-969-0x0000000005460000-0x0000000005A78000-memory.dmp

Filesize
6.1MB

Download
memory/4504-970-0x0000000005AD0000-0x0000000005BDA000-memory.dmp

Filesize
1.0MB

Download
memory/4504-971-0x0000000005C10000-0x0000000005C22000-memory.dmp

Filesize
72KB

Download
memory/4504-972-0x0000000005C30000-0x0000000005C6C000-memory.dmp

Filesize
240KB

Download
memory/4504-973-0x0000000005D80000-0x0000000005DCC000-memory.dmp

Filesize
304KB

Download