healer | a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exe
Size

658KB
MD5

1814bf637c99af2279d59a0b713f9b56
SHA1

092a21990f1ca72f2e30c85195265ebd0cc42c0b
SHA256

a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201
SHA512

b04320146156940b465962c21d08af48876229bbb00b8bcc1870881b4e61db9d711444201b2d1bede27a3d57fbf15839eaa3c77cc535338ef340c4eb704e6bff
SSDEEP

12288:QMrOy9041LZtzlM2/YUZ+DUKBdRju6vYZcpKwZDoyLgant:OyHtZEp7BS6vFKAEgt

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2516-18-0x00000000049C0000-0x00000000049DA000-memory.dmp	healer
behavioral1/memory/2516-20-0x0000000004BB0000-0x0000000004BC8000-memory.dmp	healer
behavioral1/memory/2516-24-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-48-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-46-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-44-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-42-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-40-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-38-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-36-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-34-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-32-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-30-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-28-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-26-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-21-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer
behavioral1/memory/2516-22-0x0000000004BB0000-0x0000000004BC2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro6285.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6285.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1532-60-0x0000000004B30000-0x0000000004B76000-memory.dmp	family_redline
behavioral1/memory/1532-61-0x0000000004C20000-0x0000000004C64000-memory.dmp	family_redline
behavioral1/memory/1532-62-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-95-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-93-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-91-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-89-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-87-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-85-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-83-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-81-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-79-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-77-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-75-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-73-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-71-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-69-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-67-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-65-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline
behavioral1/memory/1532-63-0x0000000004C20000-0x0000000004C5F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un589767.exepro6285.exequ8107.exe

pid process

2728 un589767.exe
2516 pro6285.exe
1532 qu8107.exe

pid	process
2728	un589767.exe
2516	pro6285.exe
1532	qu8107.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro6285.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6285.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro6285.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exeun589767.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un589767.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4492 2516 WerFault.exe pro6285.exe

pid	pid_target	process	target process
4492	2516	WerFault.exe	pro6285.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exeun589767.exepro6285.exequ8107.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un589767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro6285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu8107.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro6285.exe

pid process

2516 pro6285.exe
2516 pro6285.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro6285.exequ8107.exe

description pid process

Token: SeDebugPrivilege 2516 pro6285.exe
Token: SeDebugPrivilege 1532 qu8107.exe

pid	process
2516	pro6285.exe
2516	pro6285.exe

description	pid	process
Token: SeDebugPrivilege	2516	pro6285.exe
Token: SeDebugPrivilege	1532	qu8107.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exeun589767.exe

description	pid	process	target process
PID 396 wrote to memory of 2728	396	a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exe	un589767.exe
PID 396 wrote to memory of 2728	396	a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exe	un589767.exe
PID 396 wrote to memory of 2728	396	a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exe	un589767.exe
PID 2728 wrote to memory of 2516	2728	un589767.exe	pro6285.exe
PID 2728 wrote to memory of 2516	2728	un589767.exe	pro6285.exe
PID 2728 wrote to memory of 2516	2728	un589767.exe	pro6285.exe
PID 2728 wrote to memory of 1532	2728	un589767.exe	qu8107.exe
PID 2728 wrote to memory of 1532	2728	un589767.exe	qu8107.exe
PID 2728 wrote to memory of 1532	2728	un589767.exe	qu8107.exe

C:\Users\Admin\AppData\Local\Temp\a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exe
"C:\Users\Admin\AppData\Local\Temp\a1696721c2acd673483320eecaca33ada23f77c1cf57d68592487d7458eab201.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un589767.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un589767.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6285.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6285.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 1084
4⤵
- Program crash
PID:4492

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8107.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8107.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2516 -ip 2516
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un589767.exe

Filesize
516KB

MD5
daed6f7446135e01f18eaf43703be446

SHA1
f748fee49d92f71b3878004e1464e38a8e75a477

SHA256
7d1643a770a4292a5de23a3a7951a9e693db6b911c1ba216f3bfdc2105bf6f84

SHA512
96b00935553b822221fa071e2c1077108026b1191a7fa35764f5ebc00e1b6ff99ce277a63fe97c425534004355c51548dc49951be433202d59b6774d69e5f3fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6285.exe

Filesize
283KB

MD5
e799bceb9f99efc966379e83436975e9

SHA1
b505133a85187d7c30fc07d9a4c46a5905e04951

SHA256
853b11e56aad9f98fd437fcb3fdb4c8c85d9068a8dd34ec3ea2acbd5a2bd0712

SHA512
8210952012bfebdf7804f0d859d0a22849429c3c763ba83baca4d2c6ef2e9b38ddea43e2015d08e3b0f6f528c358bb48d2c1d1c804d58c23e2906010a8929f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8107.exe

Filesize
342KB

MD5
16116fd4b69421360f75b7ca8bcc5263

SHA1
4dcf6fcd52f3d3b16f5ab9277d0375547bd77c59

SHA256
7e7243f5ccef58e97aa38c403b778187c16af54b4437d6838c5acff482fa3c31

SHA512
0073841d5f0a570520d335063c9dc3e11e1bf1b6945989ea4b9d8270f232a721428d830f65394fbf655bc73af04d8fc5709ce68e7661c4869f1033f6d6286028

Download Submit
memory/1532-75-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-79-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-969-0x0000000007280000-0x000000000738A000-memory.dmp

Filesize
1.0MB

Download
memory/1532-968-0x0000000007990000-0x0000000007FA8000-memory.dmp

Filesize
6.1MB

Download
memory/1532-63-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-65-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-67-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-69-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-71-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-73-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-971-0x0000000007FD0000-0x000000000800C000-memory.dmp

Filesize
240KB

Download
memory/1532-972-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download
memory/1532-77-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-970-0x0000000007FB0000-0x0000000007FC2000-memory.dmp

Filesize
72KB

Download
memory/1532-81-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-83-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-85-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-87-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-89-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-91-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-93-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-95-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-62-0x0000000004C20000-0x0000000004C5F000-memory.dmp

Filesize
252KB

Download
memory/1532-61-0x0000000004C20000-0x0000000004C64000-memory.dmp

Filesize
272KB

Download
memory/1532-60-0x0000000004B30000-0x0000000004B76000-memory.dmp

Filesize
280KB

Download
memory/2516-40-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-54-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/2516-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2516-51-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/2516-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2516-50-0x0000000002CF0000-0x0000000002D1D000-memory.dmp

Filesize
180KB

Download
memory/2516-49-0x0000000002D80000-0x0000000002E80000-memory.dmp

Filesize
1024KB

Download
memory/2516-22-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-21-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-26-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-28-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-30-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-32-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-34-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-36-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-38-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-42-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-44-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-46-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-48-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-24-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/2516-20-0x0000000004BB0000-0x0000000004BC8000-memory.dmp

Filesize
96KB

Download
memory/2516-19-0x0000000007330000-0x00000000078D4000-memory.dmp

Filesize
5.6MB

Download
memory/2516-18-0x00000000049C0000-0x00000000049DA000-memory.dmp

Filesize
104KB

Download
memory/2516-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2516-16-0x0000000002CF0000-0x0000000002D1D000-memory.dmp

Filesize
180KB

Download
memory/2516-15-0x0000000002D80000-0x0000000002E80000-memory.dmp

Filesize
1024KB

Download