healer | bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exe
Size

690KB
MD5

66e80b9603379e3849c68b62a660fc05
SHA1

8978ae17f7f92fd1907734a97817c67a5f7baa11
SHA256

bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b
SHA512

c31c6af94eae083330ad5640c2870e80f492ce9bd9a66ecfb90d5a46607523fc170010184377198226cb653653d9f23556d03ad3d35e54de06b55cf985c434c5
SSDEEP

12288:BMray90Apr7L08jySFFkYbLycIy/7hEUdPBWDIfeSDtIWgv2IKrPHyYB:vypprnjNicZEiPED5SDtev0+y

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4308-19-0x00000000026C0000-0x00000000026DA000-memory.dmp	healer
behavioral1/memory/4308-21-0x0000000002830000-0x0000000002848000-memory.dmp	healer
behavioral1/memory/4308-49-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-47-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-45-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-43-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-41-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-39-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-37-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-35-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-33-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-31-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-29-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-27-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-25-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-23-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/4308-22-0x0000000002830000-0x0000000002842000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro8936.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro8936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro8936.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro8936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro8936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro8936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro8936.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1972-60-0x0000000002720000-0x0000000002766000-memory.dmp	family_redline
behavioral1/memory/1972-61-0x00000000029E0000-0x0000000002A24000-memory.dmp	family_redline
behavioral1/memory/1972-73-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-75-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-95-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-93-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-91-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-89-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-87-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-85-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-83-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-81-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-79-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-77-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-71-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-69-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-68-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-65-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-63-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline
behavioral1/memory/1972-62-0x00000000029E0000-0x0000000002A1F000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un666860.exepro8936.exequ0359.exe

pid process

548 un666860.exe
4308 pro8936.exe
1972 qu0359.exe

pid	process
548	un666860.exe
4308	pro8936.exe
1972	qu0359.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro8936.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro8936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro8936.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exeun666860.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un666860.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1804 4308 WerFault.exe pro8936.exe

pid	pid_target	process	target process
1804	4308	WerFault.exe	pro8936.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exeun666860.exepro8936.exequ0359.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un666860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro8936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu0359.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro8936.exe

pid process

4308 pro8936.exe
4308 pro8936.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro8936.exequ0359.exe

description pid process

Token: SeDebugPrivilege 4308 pro8936.exe
Token: SeDebugPrivilege 1972 qu0359.exe

pid	process
4308	pro8936.exe
4308	pro8936.exe

description	pid	process
Token: SeDebugPrivilege	4308	pro8936.exe
Token: SeDebugPrivilege	1972	qu0359.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exeun666860.exe

description	pid	process	target process
PID 4980 wrote to memory of 548	4980	bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exe	un666860.exe
PID 4980 wrote to memory of 548	4980	bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exe	un666860.exe
PID 4980 wrote to memory of 548	4980	bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exe	un666860.exe
PID 548 wrote to memory of 4308	548	un666860.exe	pro8936.exe
PID 548 wrote to memory of 4308	548	un666860.exe	pro8936.exe
PID 548 wrote to memory of 4308	548	un666860.exe	pro8936.exe
PID 548 wrote to memory of 1972	548	un666860.exe	qu0359.exe
PID 548 wrote to memory of 1972	548	un666860.exe	qu0359.exe
PID 548 wrote to memory of 1972	548	un666860.exe	qu0359.exe

C:\Users\Admin\AppData\Local\Temp\bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exe
"C:\Users\Admin\AppData\Local\Temp\bd335b666473085fadf9798ffc0213ef0256b53c3724b638b7e22469e769647b.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un666860.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un666860.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8936.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8936.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1084
4⤵
- Program crash
PID:1804

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0359.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0359.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4308 -ip 4308
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un666860.exe

Filesize
536KB

MD5
464990203ee268415c166dc6dd92a39b

SHA1
96a2208ea77a1e100666c3b54e57da21207b9e8e

SHA256
e1d295cfcfda706d19eae4b458527e5c12c6c58f5691a98277374195edff75d7

SHA512
0d7146a0fbf59e0ec84865b9bb6001d95eae8a2cde97ac8536baca82c1496500131b52d5dc3366db6d13b7364b212446af556ff8fe076b3f4db455fa3c4027e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8936.exe

Filesize
312KB

MD5
77426a0d8c787a7e7a22ab9590b8c50b

SHA1
47b94108243193a7c5d9e75b2635e38f6bde4dae

SHA256
6ef7a73803e8e2e3cf9ff6adbdb89c0cc0fad4567a0cd7ab4b59176c690c0eb5

SHA512
78deccf28b93ed61b0fe0c58bf3be44b8357b4772241b9732b34eb158cd1bca2d8917f930a193eda9c1973f9b319e389ed92f315f951eff2e990a1f576105377

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0359.exe

Filesize
370KB

MD5
4eba2327b11b723a5dbf567001d466a1

SHA1
4eb2dc4cf18fb488db396f51c55e57a701fe50d9

SHA256
0a36aa6bc4922f661ec47e70a33fd91c78761e739fd6b65db5ad9ed7f27ed1cf

SHA512
1a0c664ae379d8feea4cd42a481b974d78e39c0e963da0b70a98b0779913bde7e09b89f264838b576f15a92c4395324d8236aeda7aeae399db2f5ae01b3cea6a

Download Submit
memory/1972-77-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-81-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-969-0x0000000004F10000-0x000000000501A000-memory.dmp

Filesize
1.0MB

Download
memory/1972-968-0x00000000055F0000-0x0000000005C08000-memory.dmp

Filesize
6.1MB

Download
memory/1972-62-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-63-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-65-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-68-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-69-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-71-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-971-0x0000000005C50000-0x0000000005C8C000-memory.dmp

Filesize
240KB

Download
memory/1972-972-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Filesize
304KB

Download
memory/1972-79-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-970-0x0000000005C30000-0x0000000005C42000-memory.dmp

Filesize
72KB

Download
memory/1972-83-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-85-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-87-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-89-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-91-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-93-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-95-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-75-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-73-0x00000000029E0000-0x0000000002A1F000-memory.dmp

Filesize
252KB

Download
memory/1972-61-0x00000000029E0000-0x0000000002A24000-memory.dmp

Filesize
272KB

Download
memory/1972-60-0x0000000002720000-0x0000000002766000-memory.dmp

Filesize
280KB

Download
memory/4308-41-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4308-54-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/4308-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4308-50-0x0000000000A80000-0x0000000000B80000-memory.dmp

Filesize
1024KB

Download
memory/4308-22-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-23-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-25-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-27-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-29-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-31-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-33-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-35-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-37-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-39-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-43-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-45-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-47-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-49-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/4308-21-0x0000000002830000-0x0000000002848000-memory.dmp

Filesize
96KB

Download
memory/4308-20-0x0000000004D90000-0x0000000005334000-memory.dmp

Filesize
5.6MB

Download
memory/4308-19-0x00000000026C0000-0x00000000026DA000-memory.dmp

Filesize
104KB

Download
memory/4308-18-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/4308-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4308-17-0x0000000000400000-0x0000000000802000-memory.dmp

Filesize
4.0MB

Download
memory/4308-15-0x0000000000A80000-0x0000000000B80000-memory.dmp

Filesize
1024KB

Download