healer | d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exe
Size

658KB
MD5

bce66db35a49bf31235eae488484b12f
SHA1

50f4155983edcdf30328edeea24b4d031df0d35b
SHA256

d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f
SHA512

42244b4688148c69517c59906059439eb0a5adea5e2c44a83b679198bf9de630ea61b93059e8ff727c628f86ede2c4cd4ba950bcc2d6dc34f59558337f0cab83
SSDEEP

12288:jMrSy90YEGe6Ftp7XCQvA84InHY4o1XX6KjLQoqBie/PpJgfHkMBYT:5y4Gj7SQxpHwTnQDr/BJKVu

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3336-18-0x0000000004990000-0x00000000049AA000-memory.dmp	healer
behavioral1/memory/3336-20-0x0000000004B80000-0x0000000004B98000-memory.dmp	healer
behavioral1/memory/3336-40-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-48-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-46-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-44-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-42-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-38-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-36-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-34-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-32-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-30-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-28-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-26-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-24-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-22-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer
behavioral1/memory/3336-21-0x0000000004B80000-0x0000000004B92000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro9224.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro9224.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro9224.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro9224.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro9224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro9224.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro9224.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2520-59-0x0000000004940000-0x0000000004986000-memory.dmp	family_redline
behavioral1/memory/2520-60-0x0000000007180000-0x00000000071C4000-memory.dmp	family_redline
behavioral1/memory/2520-61-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-62-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-86-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-90-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-94-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-92-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-88-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-84-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-83-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-80-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-78-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-76-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-74-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-72-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-70-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-68-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-66-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline
behavioral1/memory/2520-64-0x0000000007180000-0x00000000071BF000-memory.dmp	family_redline

Redline family
redline
Executes dropped EXE 3 IoCs

Processes:

un599994.exepro9224.exequ6520.exe

pid process

4256 un599994.exe
3336 pro9224.exe
2520 qu6520.exe

pid	process
4256	un599994.exe
3336	pro9224.exe
2520	qu6520.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro9224.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro9224.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro9224.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exeun599994.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un599994.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4560 3336 WerFault.exe pro9224.exe

pid	pid_target	process	target process
4560	3336	WerFault.exe	pro9224.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exeun599994.exepro9224.exequ6520.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un599994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro9224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu6520.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro9224.exe

pid process

3336 pro9224.exe
3336 pro9224.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro9224.exequ6520.exe

description pid process

Token: SeDebugPrivilege 3336 pro9224.exe
Token: SeDebugPrivilege 2520 qu6520.exe

pid	process
3336	pro9224.exe
3336	pro9224.exe

description	pid	process
Token: SeDebugPrivilege	3336	pro9224.exe
Token: SeDebugPrivilege	2520	qu6520.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exeun599994.exe

description	pid	process	target process
PID 4704 wrote to memory of 4256	4704	d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exe	un599994.exe
PID 4704 wrote to memory of 4256	4704	d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exe	un599994.exe
PID 4704 wrote to memory of 4256	4704	d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exe	un599994.exe
PID 4256 wrote to memory of 3336	4256	un599994.exe	pro9224.exe
PID 4256 wrote to memory of 3336	4256	un599994.exe	pro9224.exe
PID 4256 wrote to memory of 3336	4256	un599994.exe	pro9224.exe
PID 4256 wrote to memory of 2520	4256	un599994.exe	qu6520.exe
PID 4256 wrote to memory of 2520	4256	un599994.exe	qu6520.exe
PID 4256 wrote to memory of 2520	4256	un599994.exe	qu6520.exe

C:\Users\Admin\AppData\Local\Temp\d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exe
"C:\Users\Admin\AppData\Local\Temp\d5d01d34fdd330718bf45b0ff0f520ee0b52c7e51ccab949e8df370ba32dd80f.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un599994.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un599994.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9224.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9224.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1080
4⤵
- Program crash
PID:4560

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6520.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6520.exe
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3336 -ip 3336
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un599994.exe

Filesize
517KB

MD5
30a06a5f2568ee91b4f6fc12063f991b

SHA1
989137c33307af7ee3d45ed89d9068c520878e8c

SHA256
9e055890a45a9b65cc86d60fc3cf8b7820fb9071e03dc069e08c4e2f3d610784

SHA512
e8937b1ca52727063e3609eaabd4e0dda059c41e15252aa46405495e5459b4bc89ca75590ae26749f0b211784da1f2d47d532b6770b1a11bd0e847f72dd5c2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9224.exe

Filesize
295KB

MD5
8b7ae1527647717dc29746d722062f73

SHA1
c31150a8b74492e5107daab1097acd31c4c51a56

SHA256
73776bfa6b73f83b2aeec1a012814a4356b44d0add4a9ac86b271904de9e6550

SHA512
77bae5afc0aae52a033366f1b773cc081b5b33c8f42988c95f0cc94442d7ae36def1b2332c2b7377a49d892c44e72e0f1b74148c01cc19d56a930490127d3398

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6520.exe

Filesize
354KB

MD5
ff11dc94bfc399a37df953cafc1ab10a

SHA1
d7ef226d7f6bf70657e130863ea99fe2f645b551

SHA256
4047d602022e7b3f50bbf35d30ab243aa6cafa4353e9cd53783ffb8058df0b93

SHA512
5ecba0765f822eeaf88570d035ab177a3fdb7f131ee8d7d92387fe73f748c872debb9755a8c60634a144b6455f8820e97c0ec11f3a26b5576a2fb7c16d24d075

Download Submit
memory/2520-76-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-80-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-968-0x0000000007EA0000-0x0000000007FAA000-memory.dmp

Filesize
1.0MB

Download
memory/2520-967-0x0000000007880000-0x0000000007E98000-memory.dmp

Filesize
6.1MB

Download
memory/2520-64-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-66-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-68-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-70-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-72-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-74-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-970-0x0000000007FB0000-0x0000000007FEC000-memory.dmp

Filesize
240KB

Download
memory/2520-59-0x0000000004940000-0x0000000004986000-memory.dmp

Filesize
280KB

Download
memory/2520-78-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-969-0x00000000072A0000-0x00000000072B2000-memory.dmp

Filesize
72KB

Download
memory/2520-83-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-84-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-88-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-92-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-94-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-90-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-86-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-62-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-61-0x0000000007180000-0x00000000071BF000-memory.dmp

Filesize
252KB

Download
memory/2520-60-0x0000000007180000-0x00000000071C4000-memory.dmp

Filesize
272KB

Download
memory/2520-971-0x0000000008140000-0x000000000818C000-memory.dmp

Filesize
304KB

Download
memory/3336-38-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-53-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/3336-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3336-50-0x0000000000400000-0x0000000002B78000-memory.dmp

Filesize
39.5MB

Download
memory/3336-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3336-49-0x0000000002CA0000-0x0000000002DA0000-memory.dmp

Filesize
1024KB

Download
memory/3336-21-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-22-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-24-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-26-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-28-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-30-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-32-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-34-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-36-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-42-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-44-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-46-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-48-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-40-0x0000000004B80000-0x0000000004B92000-memory.dmp

Filesize
72KB

Download
memory/3336-20-0x0000000004B80000-0x0000000004B98000-memory.dmp

Filesize
96KB

Download
memory/3336-19-0x00000000073B0000-0x0000000007954000-memory.dmp

Filesize
5.6MB

Download
memory/3336-18-0x0000000004990000-0x00000000049AA000-memory.dmp

Filesize
104KB

Download
memory/3336-16-0x0000000002DE0000-0x0000000002E0D000-memory.dmp

Filesize
180KB

Download
memory/3336-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3336-15-0x0000000002CA0000-0x0000000002DA0000-memory.dmp

Filesize
1024KB

Download